askWAM — Obtaining Microsoft Entra ID Tokens via WAM on Windows

askWAM is a tool for obtaining Microsoft Entra ID access tokens through the Web Account Manager (WAM) authentication component built into Windows. The tool uses the existing user context without triggering an interactive sign-in. It helps assess what access to cloud resources is available to the user session. The obtained tokens inherit information about the user's authentication methods and device state. According to the author, this token request method also works when Token Protection is enabled.

Capabilities: • Account selection — enumerate available WAM accounts and request tokens on behalf of a selected user • Cloud resource selection — obtain tokens for the Microsoft Graph API and other APIs by specifying a resource or requested scopes • Request configuration — request tokens with support for Continuous Access Evaluation (CAE) and pass additional token requirements via claims in JSON format

Three launch options are available: a .NET Framework client, a native x64 client, and an x64 BOF module. The BOF supports integration with the Cobalt Strike and Sliver, as well as the Mythic platform's Apollo agent. Token issuance depends on the available WAM account and the active Microsoft Entra ID policies.

Tool: https://github.com/dirkjanm/askWAM