Detect Device Token Stealing with WDAC

Robbe Van den Daele@RobbeVdDaele

•updated Aug 19, 2025•0•90

This rule detects PRT token stealing on a device when exploiting the MicrosoftAccountTokenProvider.dll, leveraging a WDAC audit policy to ingest missing Microsoft Defender for Endpoint events. This addresses a blind spot in default Defender for Endpoint detection.