Undetected Azure AD Bruteforce Attack

In late June 2021, Secureworks Counter Threat Unit researchers discovered a flaw in the protocol used by the Azure Active Directory Seamless Single Sign-On feature. This flaw allows threat actors to perform single-factor brute-force attacks against Azure Active Directory (Azure AD) without generating sign-in events in the targeted organization’s tenant.

PoC:
https://github.com/treebuilder/aad-sso-enum-brute-spray

Research:
https://www.secureworks.com/research/undetected-azure-active-directory-brute-force-attacks

#sso #azure #ad #bruteforce #research