Two SOCs, Two Outcomes: CISA Red Team Dismantles Defenses of Two Critical Infrastructures

On August 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published an advisory comparing two offensive assessments conducted in parallel. The results reveal a deep divide: one of the two organizations did not detect any malicious activity, while the other identified and isolated the initial attempts, forcing the red team to operate in an assume breach model. In both cases, however, the simulated attackers obtained full domain access, access to sensitive business systems, and cloud resources. The advisory includes no CVEs or indicators of compromise: it is an assessment report, not a bulletin about a single vulnerability.

Two Organizations, Critical Sectors, Same Objective

CISA conducted two simultaneous red team assessments. The first involved an organization in the Government Services and Facilities Sector (Organization A), the second an organization in the Water and Wastewater Systems Sector (Organization B). A red team simulates the tradecraft of real threat actors to evaluate an organization's detection, investigation, and response capabilities. The objective is to gain and maintain persistent access to the corporate network and the sensitive business systems selected by the organization itself. These systems, referred to as SBS, are applications, data stores, or infrastructure components whose compromise would have a material impact on operations, finances, or customer data.

CISA's assistance is authorized under 6 U.S.C. §§ 652(c)(5) and 659(c)(6). The report uses the MITRE ATT&CK for Enterprise framework, version 19, to map observed tactics and techniques. Exact product versions were not disclosed: the analysis focuses on widely deployed configurations and technologies such as Active Directory, Active Directory Certificate Services (ADCS), System Center Configuration Manager (SCCM), AWS IAM, and endpoint detection and response (EDR) tools.

Organization A: Full Compromise Without Any Alarm

In the case of Organization A, the red team achieved full domain compromise and access to multiple SBS and cloud resources without the defenders detecting or containing the activity. The path began with reconnaissance: a web application with default credentials for multiple integrated accounts was identified, which allowed sending email from an internal email address. That address was used for targeted phishing campaigns, leading to initial access on four workstations.

From the compromised workstations, the red team executed a modified BloodHound collector, customized to evade static EDR signatures. The tool queried Active Directory, collecting information about users, computers, groups, access control lists, organizational units, and Group Policy Objects (GPOs). One of the workstations had the default Machine Account Quota (MAQ) set to 10: this value allows non-privileged users to add up to 10 computer accounts to the domain. Combined with ADCS templates misconfigured according to the technique known as ESC1, the team was able to create a computer account and request certificates for any user or computer account. From there, lateral movement became systematic.

After gaining elevated domain privileges, the plan to access the SBS involved using Active Directory data to identify users and groups linked to sensitive systems, querying SCCM servers to enumerate user-device relationships, and locating assigned workstations. Lateral movement from the SCCM server to target user workstations enabled searching for credential material. For the first SBS, a database, clear-text credentials were found on an administrative user's workstation. For the second database, the search focused on the connections.json and product-preferences.xml files of a SQL developer tool: decrypted, they revealed the database's clear-text password. For the third SBS, an automated processing system, static long-term AWS Identity and Access Management (IAM) user credentials were acquired, saved in configuration files in the target users' home directories. The organization had not configured expiration or rotation for those credentials.

No alarm was triggered. SBS access was also extended to virtual desktops, which restrict access to active and interactive user sessions and add controls such as network segmentation for sensitive systems. Even that did not stop the red team.

Organization B: Early Detection, but Assume Breach Still Grants Access

Organization B demonstrated a very different defensive posture. It quickly identified the initial compromise attempts, quarantined the affected systems, and forced the red team to switch to an "assume breach" model. In this model, the organization's trusted agents (TA) provided access to a host that replicated the level of access the red team would have had if the defenders had not detected the initial activity.

From that host, the red team elevated privileges, moved laterally to the SBS, cloud resources, and a bastion host in the OT DMZ. Here the defenders again detected the activity and isolated the system. Access to the OT network was demonstrated without actual execution on OT systems. Despite the double detection and isolation, the assume breach model still allowed demonstrating access to SBS, cloud, and OT DMZ. Organization B's resilience slowed the attacker but did not eliminate the risk.

The Techniques Behind the Compromise: ADCS, MAQ, SCCM, and Static Credentials

The report maps activities with several MITRE ATT&CK v19 identifiers, including T1589.001 (victim identification), T1566 (phishing), T1087.002 (account discovery), T1018 (remote system discovery), T1069.002 (permission groups discovery), T1615 (Group Policy discovery), T1136.002 (domain account creation), T1649 (certificate theft or forgery), T1033 (system owner/user discovery), T1552 (unsecured credentials), and T1552.001 (credentials in files).

The combination of default Machine Account Quota and ADCS templates vulnerable to ESC1 is particularly dangerous. MAQ allows a normal user to create computer accounts; ESC1 allows requesting certificates for any account, including newly created ones. The result is a privilege escalation path that is difficult to detect if the EDR is not properly tuned. The modified BloodHound collector bypassed static signatures, demonstrating that protection based solely on known signatures is insufficient against customized offensive tools.

Static long-term AWS IAM credentials represent another serious flaw. Without expiration or rotation, once stolen they remain valid indefinitely. The connections.json and product-preferences.xml files from the SQL developer tool contain passwords encrypted with weak or reversible algorithms: anyone who finds them can decrypt them and gain direct database access.

Why Defenders Fail: Silos, Noise, and Underestimated Cloud

The comparison between the two organizations highlights recurring problems. Untuned detection tools lead to undetected threats. Without defined baselines and alert filtering, false positives and routine notifications overload network defenders, who end up ignoring real signals. In Organization A, this allowed the attacker to move undisturbed for hours or days.

Organizational silos and bureaucratic obstacles prevent effective incident response. Fragmented communication, unclear responsibilities, and limited defender authority hinder incident response even when alerts are generated. In Organization B, although the initial response was swift, the need to switch to the assume breach model indicates that internal processes could have slowed or complicated the reaction to a real attack.

Cloud environments are often an underestimated risk. Specific security controls and processes for responding to a cloud compromise are lacking. Static IAM credentials and non-rotated access tokens represent an increasingly exploited attack vector, but many organizations do not have procedures to detect and revoke these elements during an incident.

CISA Recommendations to Reduce Risk

The advisory lists four key actions. First, establish and continuously maintain a baseline and reduce alert noise through fine-tuning. Second, break down silos and empower network defenders by assigning clear authority and communication channels. Third, implement Conditional Access policies for workload identities and monitor excessive or unused permissions. Fourth, establish and regularly review comprehensive procedures for detecting, remediating, and revoking access and refresh tokens in the event of a cloud compromise.

Target audiences include Federal Civilian Executive Branch agencies, state, local, tribal, and territorial governments, and critical infrastructure. Roles involved range from system administrators to incident responders, from defensive cybersecurity analysts to vulnerability analysts, from network operators to security system managers. The message is clear: misconfigurations and static credentials are the preferred entry point for attackers, and a SOC that cannot filter the noise does not even see successful attacks.