Skip to content

Add WWAHost.exe AppX-hosted JavaScript execution entry #527

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Liran017 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add WWAHost.exe AppX-hosted JavaScript execution entry #527

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions yml/OSBinaries/Wwahost.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
---
Name: WWAHost.exe
Description: Microsoft-signed Windows Web App Host binary that hosts web content inside AppX packages. An AppX package whose manifest grants WindowsRuntimeAccess="all" to an attacker-controlled origin can load attacker-hosted JavaScript inside WWAHost.exe with full Windows Runtime access.
Author: Liran Ravich
Created: 2026-10-01
Commands:
- Command: Add-AppxPackage -Register .\AppxManifest.xml
Description: Registers an AppX package configured through ContentUriRules to load attacker-hosted JavaScript inside WWAHost.exe. Developer Mode or an enterprise sideloading policy must already be enabled; otherwise, registration fails with error 0x80073CFF.
Usecase: Register an AppX package that loads attacker-hosted JavaScript inside a Microsoft-signed system host with Windows Runtime access.
Category: Execute
Privileges: User
MitreID: T1218
OperatingSystem: Windows 11
- Command: Add-AppxPackage -Register .\AppxManifest.xml
Description: The remote JavaScript hosted inside WWAHost.exe calls Windows Runtime authentication APIs to capture OAuth access and refresh tokens issued by Microsoft's own login flow.
Usecase: Steal application access tokens through a Microsoft-signed host, surviving multi-factor authentication because the user authenticates legitimately.
Category: Credentials
Privileges: User
MitreID: T1528
OperatingSystem: Windows 11
Full_Path:
- Path: C:\Windows\System32\WWAHost.exe
- Path: C:\Windows\SysWOW64\WWAHost.exe
Detection:
- IOC: WWAHost.exe making outbound network connections to a non-Microsoft origin
- IOC: AppX package registration by a standard user with Developer Mode enabled
- Analysis: https://www.huntress.com/blog/stealing-oauth-tokens-through-microsofts-front-door
Resources:
- Link: https://www.huntress.com/blog/stealing-oauth-tokens-through-microsofts-front-door
- Link: https://learn.microsoft.com/en-us/uwp/schemas/appxpackage/uapmanifestschema/element-uap-rule
Acknowledgement:
- Person: Liran Ravich, Cribl
Loading