# Malware Abuses Windows Hello for Business Key to Authenticate to Microsoft Entra ID

> Researcher Dirk-jan Mollema demonstrated that malware already running in a signed-in Windows session can silently invoke a victim's Windows Hello for Business (WHFB) private key to authenticate to Microsoft Entra ID, without extracting the TPM-backed key, recovering the PIN, or triggering a biometric prompt. The technique lets an attacker request a Primary Refresh Token (PRT) for persistent SSO access, register an attacker-controlled device, and treat the WHFB key as a FIDO2 passkey via WebAuthn to authenticate from a separate machine without the original device identifier.

- **Published:** 2026-08-09T00:00:00Z
- **Last reviewed:** 2026-08-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1952
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-windows-hello-key-abuse-tl-2026-1952.webp?v=1bfb14b9 (Threadlinqs threat intel: Windows Hello for Business Key Abuse: Detection & IOCs (TL-2026-1952) — High severity, 11 IOCs, 9 detection rules.)
- **ID:** TL-2026-1952
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 11

## Description

Windows Hello for Business (WHFB) keeps its per-device authentication private key inside the TPM and normally requires a PIN or biometric gesture to unlock it. Dirk-jan Mollema's research (building on his and Ceri Coburn's DEF CON 32 talk 'Abusing Windows Hello Without a Severed Hand' and its follow-ups, and on Benjamin Delpy's earlier mimikatz work exploring WHFB key operations) shows that Windows caches the unlocked state of that key as a 'ticket' for the duration of an interactive sign-in. Windows exposes two Cryptography API: Next Generation (CNG) key storage providers for WHFB keys: the Platform Key Storage Provider, which re-prompts for a PIN/biometric on each signing operation, and the Passport Key Storage Provider, which serves signing requests from the cached ticket instead. Any code running as the signed-in user -- including PowerShell, with no elevation required -- can call the Passport KSP through NCrypt.dll (e.g. `NCryptOpenKey`) and request signatures from the cached key without a fresh PIN or biometric prompt, because the operation is served from the cached ticket rather than a live user-presence check.

The original abuse path signs a locally generated JWT assertion (valid roughly 5 minutes) with the borrowed key and exchanges it for a Microsoft Entra ID Primary Refresh Token (PRT) -- a long-lived (up to 90 days, renewable) SSO artifact that grants broad access to Microsoft cloud services without re-prompting the user; RDP sessions are noted as a common legitimate vector that already exercises WHFB signing and can mask this abuse. Mollema's newer research (published 2026-08-05 as 'Borrowing Windows Hello keys for authentication and persistence') extends this by treating the WHFB key as a FIDO2 passkey through the WebAuthn protocol: the attacker fetches an Entra-issued WebAuthn challenge (a JWT prefixed 'O.', valid roughly five minutes, and notably not bound to any particular session, user, or tenant) on an attacker-controlled host, has the compromised, signed-in endpoint sign it with the victim's WHFB key using a PowerShell PoC (`fido_assertion.ps1`), and then completes the WebAuthn ceremony from the separate attacker-controlled machine using ROADtools' `roadtx fidoauth`. Constructing a valid assertion requires deriving the WebAuthn `user_handle` value, which Mollema documents as the static string `ON:` concatenated with the tenant ID (little-endian binary) and a SHA256 hash of the user ID. Because the resulting token can lack a bound device-ID claim, the attacker can use it to register a new, attacker-controlled device in the tenant via `roadtx`, request a Web Account Manager (WAM) broker refresh token for that device, and obtain a fresh PRT tied to attacker-controlled hardware rather than the victim's original device -- with continued renewal thereafter, independent of the original compromised host. Because the WebAuthn/FIDO2 flow satisfies Conditional Access policies that require phishing-resistant authentication strength, and because it counts as fresh multi-factor authentication, tenant policy permitting, the attacker can also enroll additional passkeys or WHFB keys on the new device via `roadtx registerpasskey` (which requires the `UserAuthenticationMethod.ReadWrite` scope and an `ngcmfa` claim, and is blocked where FIDO2 attestation enforcement is configured), creating durable backdoor authentication material independent of the original compromised host.

Publicly available proof-of-concept tooling exists in Dirk-jan Mollema's ROADtools framework (roadtx subcommands `fidoauth` and `registerpasskey`, and PowerShell scripts including `hellopoc.ps1` and `fido_assertion.ps1` in the `winhello_assertion` folder), meaning the barrier to reproducing the technique is low for anyone with existing code execution in a target's signed-in session. No CVE has been assigned and no vendor patch has shipped as of 2026-08-07; this is a design-level abuse of cached authentication state rather than a single, patchable memory-safety bug, and there are no reports of confirmed in-the-wild exploitation or named victims. The primary detection signal identified by both the researcher and independent write-ups (e.g. Hybrid Brothers, 2025-04-26) is Entra ID sign-in telemetry showing a Windows Hello for Business authentication method with an empty/blank device ID -- a state that is unusual outside of legitimate incognito or non-SSO-capable browser sessions.

## MITRE ATT&CK

- T1588.002 Tool
- T1059.001 PowerShell
- T1098.005 Device Registration
- T1556.006 Multi-Factor Authentication
- T1078.004 Cloud Accounts
- T1098.005 Device Registration
- T1550.001 Application Access Token
- T1111 Multi-Factor Authentication Interception
- T1528 Steal Application Access Token
- T1606 Forge Web Credentials
- T1021.007 Cloud Services

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Passport KSP / NCrypt WHFB Key Abuse from Scripting Host (Exploitation)** (`TL-2026-1952-SPL-001`)

Detects the core local-abuse primitive: a scripting host or non-standard process loading ncrypt.dll (the Passport Key Storage Provider) to call NCryptOpenKey against a cached Windows Hello for Business ticket, or invoking the publicly available hellopoc.ps1 / fido_assertion.ps1 PoC scripts from the ROADtools winhello_assertion folder. This is the step that lets malware already running in a signed-in session sign a JWT/WebAuthn assertion with the victim's TPM-backed WHFB key without a fresh PIN or biometric prompt.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.001, T1606, T1111
- **Data sources:** sysmon, windows_security, entra_id_signin_logs
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=7 ImageLoaded="*\\ncrypt.dll" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\powershell_ise.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\rundll32.exe"))
OR (EventCode=1 (CommandLine="*hellopoc.ps1*" OR CommandLine="*fido_assertion.ps1*" OR CommandLine="*winhello_assertion*" OR CommandLine="*NCryptOpenKey*"))
| eval detection_reason=if(EventCode=7, "ncrypt.dll (Passport KSP) loaded by scripting host", "known WHFB-abuse PoC script or NCrypt API referenced on command line")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(detection_reason) as reasons by Computer, User, Image
| where count >= 1
| sort -last_seen
```

### Microsoft KQL

```kql
SigninLogs
| where TimeGenerated > ago(24h)
| where AuthenticationDetails has '"authenticationMethod":"Windows Hello for Business"'
| extend deviceId = tostring(DeviceDetail.deviceId)
| where isempty(deviceId)
| extend browser = tostring(DeviceDetail.browser), os = tostring(DeviceDetail.operatingSystem)
| where browser !has "InPrivate" and browser !has "Incognito"
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location, browser, os, deviceId, ConditionalAccessStatus, ResultType
```

### Sigma

```yaml
title: Passport KSP (NCrypt) Loaded by Scripting Host
id: 6f2f6a0e-3b6a-4c2c-9e6a-7a2f8f0c1b31
status: experimental
description: Detects ncrypt.dll (Windows Hello for Business Passport Key Storage Provider) being loaded by a scripting host or living-off-the-land binary, consistent with non-privileged abuse of a cached WHFB signing ticket to forge Entra ID authentication assertions without a PIN/biometric prompt.
references:
  - https://dirkjanm.io/borrowing-windows-hello-keys/
  - https://hybridbrothers.com/detecting-non-privileged-windows-hello-abuse/
  - https://github.com/dirkjanm/ROADtools
author: Threadlinqs Team
date: 2026-08-09
tags:
  - attack.execution
  - attack.t1059.001
  - attack.credential-access
  - attack.t1606
  - attack.t1111
  - attack.tool.roadtools
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\powershell_ise.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\rundll32.exe'
    ImageLoaded|endswith: '\ncrypt.dll'
  condition: selection
falsepositives:
  - Legitimate Windows Hello / smart-card credential prompts triggered by scripted login automation or admin tooling that legitimately signs with the platform KSP
  - Security software instrumenting CNG APIs for telemetry
level: high
```

**Known false positives:**

- Legitimate admin/RMM PowerShell tooling or security agents that legitimately load ncrypt.dll for unrelated CNG operations
- Smart-card or FIDO2 hardware-key software that also loads ncrypt.dll from a scripting context

**Tuning notes:** Baseline which processes on your fleet legitimately load ncrypt.dll (EDR agents, smart-card middleware) and add them to an allowlist; correlate hits with the SPL-002/KQL-002 device-registration detections to prioritize alerts where a device-ID-less WHFB sign-in follows within the hour.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Windows Hello for Business Sign-In with Empty Entra Device ID (Exploitation) (locked: unlock with TL Creds)
- New Device Registration or MFA-Method Add Shortly After Blank-Device WHFB Sign-In (Post-Exploitation) (locked: unlock with TL Creds)
- Attacker-Controlled Device Inheriting Existing User's PRT Chain via Cloud Services (C2 / Lateral Movement) (locked: unlock with TL Creds)
- Sigma: Passport KSP (NCrypt) DLL Load by Non-Standard Process (Exploitation) (locked: unlock with TL Creds)
- Sigma: Entra ID Device/Authentication-Method Registration Event (Post-Exploitation) (locked: unlock with TL Creds)
- Sigma: Entra Sign-In with ROADtools-Style User Agent or Blank-Device WHFB Auth (C2 / Lateral Movement) (locked: unlock with TL Creds)
- Device Registration or Auth-Method Enrollment Following Blank-Device-ID WHFB Sign-In (Post-Exploitation) (locked: unlock with TL Creds)
- ROADtools/roadtx-Style Sign-In Pattern with Cross-IP PRT Reuse (C2 / Lateral Movement) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Malware Abuses Windows Hello for Business Key to Authenticate Microsoft Entra ID](https://cybersecuritynews.com/malware-abuses-windows-hello-key/)
- [Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access](https://thehackernews.com/2026/08/malware-can-abuse-windows-hello-for.html)
- [Windows Hello Key Abuse Lets Attackers Access Microsoft Entra ID Accounts](https://gbhackers.com/windows-hello-key-abuse/)
- [Borrowing Windows Hello keys for authentication and persistence](https://dirkjanm.io/borrowing-windows-hello-keys/)
- [Windows Hello abuse - The sequel (Dirk-jan Mollema @ Ekoparty)](https://dirkjanm.io/assets/raw/Windows%20Hello%20abuse%20the%20sequel.pdf)
- [ROADtools - Azure AD/Entra ID interaction framework](https://github.com/dirkjanm/ROADtools)
- [Detecting non-privileged Windows Hello abuse](https://hybridbrothers.com/detecting-non-privileged-windows-hello-abuse/)
- [DEF CON 32 - Abusing Windows Hello Without a Severed Hand (Ceri Coburn, Dirk-jan Mollema)](https://www.youtube.com/watch?v=mFJ-NUnFBac)
- [MITRE ATT&CK T1606 - Forge Web Credentials](https://attack.mitre.org/techniques/T1606/)
- [MITRE ATT&CK T1098.005 - Account Manipulation: Device Registration](https://attack.mitre.org/techniques/T1098/005/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1952