CISA published results of simultaneous red team assessments conducted against two critical infrastructure organizations using similar tradecraft. Both organizations were fully compromised at the domain level. The assessments revealed sharply different defensive outcomes between the two organizations. One organization failed to detect any of the red team's activities throughout the engagement. The findings highlight significant gaps in detection and response capabilities within critical infrastructure sectors. The report serves as a warning about the state of cybersecurity readiness in critical infrastructure. CISA used the assessments to demonstrate the importance of robust monitoring, detection, and incident response capabilities.
CISA conducted two simultaneous red team assessments (advisory AA26-237A, 'A Tale of Two SOCs', released August 25, 2026) against two critical infrastructure organizations using similar tradecraft. Organization A (Government Services and Facilities Sector) was fully compromised without detection. Initial access was obtained via a web application with default credentials used to send internal phishing emails, landing on four workstations. Privilege escalation was achieved by abusing the default Machine Account Quota and a misconfigured Active Directory Certificate Services (AD CS) template (ESC1-style, related to the Certighost exploit). Cleartext credentials found in decrypted database config files and static non-expiring AWS access keys allowed access to three sensitive business systems (SBSs). In the cloud, a Primary Refresh Token was stolen and over-permissioned Entra ID applications were abused to read security team emails and monitor defender awareness. Organization A failed to detect any activity due to thousands of false-positive alerts obscuring real ones, multiple siloed SOCs and endpoint tools with no shared visibility, lack of escalation procedures, limited analyst authority, and a real alert on an SCCM server being dismissed as a false positive. Organization B (Water and Wastewater Systems Sector) successfully detected initial phishing payloads upon execution and isolated affected workstations within 2-20 minutes, severing C2 communications. CISA then shifted to an assume-breach model using a trusted agent. In the assume-breach phase against Organization B, cleartext credentials for a domain service account were found in an SCCM configuration file with rights over a domain controller, enabling a DCSync attack to retrieve the krbtgt secret. A bastion host in the OT DMZ was reached but blocked outbound internet, preventing C2 establishment and OT system access. CISA attributed the outcome difference to people and processes rather than tools.
1. Set Machine Account Quota (ms-DS-MachineAccountQuota) to 0 to prevent domain users from adding machine accounts. 2. Audit and remediate AD CS certificate templates, specifically removing the ESC1 misconfiguration that allows certificate requests for arbitrary users. 3. Remove cleartext credentials from configuration files, database config files, and SCCM configuration files; use secrets management solutions. 4. Rotate and enforce expiration policies on all cloud access keys (AWS, Azure); implement token revocation procedures. 5. Review and restrict Entra ID application permissions, removing over-permissioned mail read access across all users; apply least-privilege principles. 6. Consolidate SOC visibility across all endpoint tools and security platforms to eliminate siloed monitoring. 7. Reduce alert fatigue by tuning and prioritizing alerts to surface genuine threats; implement robust false-positive management. 8. Establish clear escalation procedures and empower analysts with authority to act on alerts. 9. Implement assume-breach exercises and purple team assessments to validate detection and response capabilities. 10. Enforce network egress controls on OT demilitarized zone bastion hosts to block unauthorized outbound internet access. 11. Regularly audit and rotate krbtgt account passwords to mitigate DCSync and Golden Ticket attacks.
