5 minhigh
Stealing OAuth Tokens Through Microsoft's Front Door
A sideloaded AppX package abuses WWAHost.exe and WinRT WebAuthenticationBroker to present a real Microsoft login dialog and steal OAuth tokens that survive MFA. The attack requires Developer Mode or an enterprise sideloading policy. A standard user registers a minimal AppX package whose manifest grants remote JavaScript full WinRT access via WindowsRuntimeAccess="all". The JavaScript calls WebAuthenticationBroker with Microsoft Office's client ID, presenting a legitimate login.microsoftonline.com dialog. Captured refresh tokens persist across networks until revoked.
Sens:▲ 24hConf:high
IOCs3
1filename1file path1registry key
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Deploy MSAppHost/3.0 proxy rule excluding Microsoft-owned domains
- Audit and disable Developer Mode on standard end-user machines via GPO
- Revoke refresh tokens for users on machines with Developer Mode enabled
Key Takeaways
- Developer Mode or AllowAllTrustedApps sideloading policy is the prerequisite gate.
- Attack uses Microsoft Office client ID d3590ed6-52b3-4102-aeff-aad2292ab01c with urn:ietf:wg:oauth:2.0:oob redirect.
- Captured tokens carry broad Graph scopes including AuditLog.Create, Mail.ReadWrite, Files.ReadWrite.All.
- Detection keys on MSAppHost/3.0 user agent to non-Microsoft destinations; one proxy rule covers the class.
- Refresh tokens mint new access tokens from any network without re-authentication or MFA.
Attack Chain
- Prerequisite: Developer Mode or AllowAllTrustedApps sideloading policy enabled on target
- Initial Access: Attacker delivers sideloaded AppX package via social engineering pretext
- Execution: Add-AppxPackage -Register runs as standard user, no UAC or signature check
- OAuth Theft: Attacker JavaScript calls WebAuthenticationBroker with Office client ID; user completes real MFA
- Exfiltration: Authorization code POSTed to attacker listener, exchanged for access and refresh tokens
- Persistence: Refresh token mints new access tokens from any network without re-authentication
Affected Systems
- Windows 11 24H2 (build 26100)
- Windows machines with Developer Mode enabled
- Windows machines with AllowAllTrustedApps sideloading policy
- Entra ID (Azure AD) tenants with MFA enabled
Detection Availability
- Published: Sigma
- Platforms: Sigma
Sigma rule for proxy logs detecting MSAppHost/3.0 user agent to non-Microsoft destinations.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | WWAHost.exe is signed; Add-AppxPackage and DLL loads from user paths are visible via Sysmon. |
| Network Visibility | High | MSAppHost/3.0 user agent to non-Microsoft destinations is unconditionally anomalous on proxy logs. |
| Detection Difficulty | Moderate | Network rule is high-confidence and low-noise; endpoint corroboration requires Sysmon or native event auditing. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| AppX host process (WWAHost.exe) making outbound network connections to non-Microsoft IP addresses (T1071) | Sysmon Event ID 3, Windows Security Event ID 5156 | Command and Control | Low — AppX hosts rarely contact non-Microsoft endpoints |
| Add-AppxPackage -Register invoked with manifest path outside C:\Program Files\WindowsApps (T1059.001) | Sysmon Event ID 1, PowerShell Event ID 4104 | Execution | Medium — developer machines legitimately register packages |
| AppxManifest.xml in user-writable paths containing WindowsRuntimeAccess=all with external URL (T1547) | File system monitoring, PowerShell script-block logging | Persistence | Low — legitimate manifests reside in Program Files |
| Refresh token redemption from new IP or device without prior sign-in activity (T1528) | Entra ID sign-in logs, Conditional Access logs | Credential Access | Medium — users travel between networks |
Required Log Sources
- Proxy logs with user-agent field
- Sysmon Event ID 1 (process creation)
- Sysmon Event ID 3 (network connections)
- Sysmon Event ID 7 (image load)
- AppXDeploymentServer/Operational Event ID 400
- Windows Security Event ID 5156
Key Behavioral Indicators
- MSAppHost/3.0 user agent to non-Microsoft destinations on proxy
- WWAHost.exe outbound connections to non-Microsoft IPs
- Add-AppxPackage -Register with paths outside Program Files\WindowsApps
- AppxManifest.xml in user-writable paths with WindowsRuntimeAccess=all
- DLL loads from AppData\Local\Packages instead of System32
- Entra sign-in with MSAuthHost/1.0 user agent for Office client ID
Control Gaps
- Signature-based AV cannot flag signed Microsoft binaries executing documented APIs
- Entra sign-in logs show normal Office authentication with no risk flags
- Conditional Access may not block token use from compliant device state
- SmartScreen does not intercept Add-AppxPackage -Register with Developer Mode
False Positive Assessment
Low — MSAppHost/3.0 user agent to non-Microsoft destinations has no benign explanation; allow-list tuning handles Microsoft Store telemetry.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Set Allow all trusted apps to install GPO to Disabled
- Require compliant/managed devices for token issuance via Conditional Access
- Shorten refresh-token lifetimes and enable Continuous Access Evaluation
User Protection
- Block Add-AppxPackage -Register execution for standard users via AppLocker
- Monitor AppXDeploymentServer Event ID 400 for non-standard package registrations
- Enable Windows Filtering Platform auditing for Security Event ID 5156
Security Awareness
- Warn developers that Developer Mode enables sideloaded AppX packages without signature checks
- Train users to report unexpected Microsoft login dialogs outside a browser
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping6 techniques
Tactic
Execution
Tactic
Stealth
Tactic
Credential Access
Additional IOCs
- Registry Keys:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock- Registry path for Developer Mode and sideloading policy toggle
- File Paths:
C:\Users\*\AppData\Local\Packages\MicrosoftAccountVerification\AppxManifest.xml- Sideloaded package manifest with WindowsRuntimeAccess=all
- Command Lines:
- Purpose: Register sideloaded AppX package as standard user | Tools:
PowerShell,Add-AppxPackage| Stage: Execution |Add-AppxPackage -Register .\AppxManifest.xml - Purpose: Enable Developer Mode via registry (requires admin) | Tools:
reg.exe,PowerShell| Stage: Persistence
- Purpose: Register sideloaded AppX package as standard user | Tools:
- Other:
d3590ed6-52b3-4102-aeff-aad2292ab01c- Microsoft Office first-party client ID used for OAuth token theftMSAppHost/3.0- User agent string from EdgeHTML engine used for detection
Showing defanged values
- filenameMicrosoftAccountVerification_1.0.0.0_neutral__ap5pwk43ghhtpSideloaded AppX package name used in PoC attack
- file_pathC:\Users\*\AppData\Local\Packages\MicrosoftAccountVerification\AppxManifest.xmlSideloaded package manifest with WindowsRuntimeAccess=all
- registry_keyHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlockRegistry path for Developer Mode and sideloading policy toggle
Stay currentSubscribe via RSS