Detects anomalous execution of BrowserCore.exe, the Windows component used by Chromium-based browsers for native messaging with Web Account Manager (WAM). Adversaries abuse BrowserCore to extract Entra ID Primary Refresh Tokens (PRTs) without interactive browser context, enabling session hijacking. Legitimate BrowserCore launches include a chrome-extension:// argument from the browser native-messaging host; this rule flags browsercore.exe starts where the command line does not contain that URI, implying potential credential theft via PRT extraction. The detector looks for Windows process-start events where the process name is browsercore.exe, with a non-null parent process and non-null command_line, and it does not see a chrome-extension:// token. Telemetry collected includes timestamp, host, user, and process/parent details to enable investigation. The rule integrates signals from multiple data sources (Elastic Defend, Sysmon, Windows Security Event Logs, CrowdStrike, SentinelOne, M365 Defender) to support cross-source validation and rapid containment if a threat is suspected.