A critical vulnerability within Microsoft’s Azure Active Directory (Azure AD) protocol allows attackers to perform undetected single-factor brute-force attacks without being forced to a sign-in portal. The flaw exists in Azure’s Seamless Single Sign-On feature, which relies on the Kerberos protocol for authentication, and allows organization employees to automatically sign their devices in to their account when their device connects to an authorized corporate network. There are two autologon endpoints involved in the authentication called “windowstransport,” and “usernamemixed,” and it is with these two endpoints that the vulnerability exists. If the authentication instance fails, then instead of automatically logging in, the user will receive error codes, and those errors are not properly logged by Azure, which is where the exploit comes in to effect because most security tools that detect brute-force attempts rely on sign-in logs. A statement from a Secureworks Counter Threat Unit (CTU) researcher explains, “Successful authentication events generate sign-ins logs… However, autologon’s authentication [step] to Azure AD is not logged. This omission allows threat actors to utilize the usernamemixed endpoint for undetected brute-force attacks.” This vulnerability is not limited to Azure AD and can also be exploited in any Microsoft 365 organizations. The flaw has not yet been patched or mitigated, and the Ankura CTAPT will continue to monitor this matter to provide an update to our readers as the information becomes available.