Recovery of Azure tokens from `Office`. ## Tweets - https://twitter.com/_xpn_/status/1582069632302620673 <blockquote class="twitter-tweet"><p lang="en" dir="ltr">Quick blog post after spending the weekend looking at how Azure auth tokens are loaded into Office, how we can recover them from the Token Broker cache, and some MSA authentication RPC internals thrown in for good measure. <a href="https://t.co/xJRCRGnOfT">https://t.co/xJRCRGnOfT</a></p>&mdash; Adam Chester (@_xpn_) <a href="https://twitter.com/_xpn_/status/1582069632302620673?ref_src=twsrc%5Etfw">October 17, 2022</a></blockquote> ## Links - https://blog.xpnsec.com/wam-bam/ - https://mrd0x.com/stealing-tokens-from-office-applications/?no-cache=1