THREATOPS

THREAT OPS › Threat News › WS-Trust Autologon Endpoint: Password Spray Without Smart Lockout Blocking

WS-Trust Autologon Endpoint: Password Spray Without Smart Lockout Blocking

medvaronis_blogPublished 2026-08-12

<p>A legacy Entra ID endpoint kept alive for Office 2013 clients lets attackers spray passwords past Smart Lockout, confirm valid credentials on MFA-protected accounts, and leave only partial logs behind.</p> <p>In 2018, Microsoft introduced <a href="https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-smart-lockout">Smart Lockout</a> into Azure AD, now Entra ID, to make

MITRE ATT&CK techniques

Adversary-in-the-MiddleT1557
Social EngineeringT1684
Password SprayingT1110.003
Valid AccountsT1078
CredentialsT1589.001
Valid AccountsAML.T0012

Indicators of compromise

https://autologon.microsoftazuread-sso.com/{tenant}/winauth/trust/2005/usernamemixedurl
http://login.microsoftonline.com/common/GetCredentialTypeurl
https://aadinternals.com/post/desktopsso/url
https://www.secureworks.com/research/undetected-azure-active-directory-brute-force-attacksurl
track.hubspot.comdomain
2fwww.varonis.comdomain
252fwww.varonis.comdomain

Original source: https://www.varonis.com/blog/ws-trust-autologon-endpoint