CISA Red Teamed Two Critical Networks. One SOC Caught It in Minutes.

CISA’s red team reached full domain compromise at two critical infrastructure organisations using much the same tradecraft. At one, the security operations centre isolated every infected workstation within 2 to 20 minutes. At the other, nobody reacted and the red team logged into the security team’s own mailbox to see whether anyone had.

The comparison was published on 25 August 2026 as advisory AA26-237A, titled “A Tale of Two SOCs”. CISA names neither target. Organisation A is a Government Services and Facilities Sector body. Organisation B is a Water and Wastewater Systems Sector operator. Both were assessed at the same time and in both cases the red team took the domain, reached sensitive business systems and got into the cloud tenant.

The Alerts Fired in Both Networks

Organisation A’s SOC did receive alerts. CISA records medium and low severity EDR detections tied directly to red team activity, none of which were actioned. Thousands of false positives generated by ordinary business operations, many of them rated higher than the real detections, drowned them out.

The organisation ran multiple SOCs and multiple EDR products with no shared visibility between them. Analysts had no escalation procedures and limited authority to act which CISA says left them defaulting to a wait and see approach. In one exchange the red team read from a compromised workstation, defenders were trying to establish who owned a System Center Configuration Manager server and what it did. They could not find out and closed the alert as a false positive.

Organisation A was not short of tooling. It had more detection products than Organisation B and got less out of them. CISA puts it plainly, “Detection tools are only as effective as the people, processes and procedures supporting them.”

A Default Setting and a Certificate Template Were Enough

Initial access at Organisation A came through a web application still running default credentials on several built-in accounts. That gave the red team the ability to send mail from an internal address and phishing from inside the organisation landed on four workstations.

From there the team ran a modified BloodHound collector, customised to slip past static EDR signatures and pulled the whole Active Directory picture, users, computers, groups, access control lists, organisational units and group policy objects. One compromised workstation still had the Machine Account Quota at the Windows default of 10 so any unprivileged user could add computer accounts to the domain. Several certificate templates carried the ESC1 misconfiguration which lets any user request a certificate on behalf of any other user or computer. Chain the two together and you have a route to domain privileges, create a machine account, request a certificate for it, then request certificates for whichever account you want.

Credential hygiene did the rest. Cleartext credentials on an administrator’s workstation opened the first database. For the second, the team pulled the connections.json and product-preferences.xml files belonging to a SQL developer tool and decrypted the stored password. The third system was reached with static AWS IAM keys sitting in configuration files in users’ home directories with no expiry and no rotation configured.

The virtual desktop layer fell the same way. Those desktops synchronise with the root drive of a distributed file system so compromising the root handed the team the local files of every user’s virtual desktop whether or not a session was active. Credential and database connection files for thousands of users sat in one place.

In the cloud, the team enumerated Entra ID with AzureHound and ROADrecon, identified applications holding Application permissions including Mail.ReadWrite, moved laterally to one application owner’s machine and stole that user’s Primary Refresh Token. They used it to add a new client secret to the application, then read mail as the application. What they read was the SOC’s inbox. They were checking whether anyone had noticed them. Nobody had.

Organisation B Cut the Foothold in Two Minutes

Organisation B was phished the same way. Three users clicked and three workstations called home. Each payload execution raised a medium severity alert about an executable loading an unexpected DLL. SOC staff triaged all three and manually isolated the machines after 10, 2 and 20 minutes, then reimaged them before putting them back online.

That is the same severity band Organisation A left sitting in the queue. The difference in outcome came from a tuned baseline and analysts who were allowed to quarantine a machine without waiting for approval.

With the foothold gone, CISA switched to an assume breach model. Organisation B’s trusted agents ran a red team payload on a designated host tied to a standard account with no administrative privileges recreating the access the team would otherwise have held.

What the team found next was worse than Organisation A’s configuration in one respect. Organisation B had the Machine Account Quota set to 1,000 for every domain user. An SCCM distribution point held an XML file containing the cleartext password for a domain service account, and that account had object control over close to 1,000 accounts plus AllExtendedRights on a domain controller. The team used it to run a resource based constrained delegation attack, obtained DCSync rights and pulled the krbtgt secret.

The OT network held. The team found RDP files pointing at a bastion host in the OT demilitarised zone and logged in over SSH using FTP credentials which gave them visibility of the OT subnets. Their payloads never called back because the host blocked outbound internet connections, and the execution attempt raised an alert that led staff to quarantine it. The team never entered the OT systems themselves.

Organisation B’s controls did not prevent domain compromise. They prevented it from being quiet.

Cloud Was the Shared Weakness

Both organisations failed in the same place. Neither had Conditional Access for workload identities, the control that extends access policy to the service principals behind applications rather than only to user accounts. CISA notes that its red team has never observed an assessed organisation using it. Both granted broad Application permissions to most of their applications and in both environments the team used those permissions to read mail.

Neither had a process for revoking compromised access and refresh tokens. At Organisation B the team eventually found an application permitted to read, write and send mail for every user in the tenant, owned by an AD synchronised account that had been disabled. They re-enabled the account, DCSynced its credentials and added a client secret. Mail for the entire organisation was then reachable from the public internet.

Most security teams can describe how they would evict an intruder from Active Directory. Far fewer can describe how they would revoke every live refresh token in their tenant. That gap is what keeps a cloud compromise alive after the on-premises cleanup has been declared finished.

The 24 Hour Clock Starts When Somebody Notices

Sweden’s Cybersäkerhetslagen has been in force since January 2026 and water supply, wastewater and public administration all sit inside its scope. NIS2 requires an early warning to the supervisory authority within 24 hours of becoming aware of a significant incident and a full notification within 72 hours.

Read Organisation A’s timeline against that requirement. Domain compromise, three sensitive business systems, cloud mailbox access and intruders reading the SOC’s own inbox, with no awareness at any stage. An organisation in that position does not miss the 24 hour deadline. It never starts the clock.

Six Changes Worth Making Before the Next Assessment

Set the Machine Account Quota to zero unless a documented business need exists. Both assessed organisations left it exploitable, one at the default of 10 and one at 1,000.
Remove the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag from certificate templates and strip enrolment and write permissions from Domain Users. That closes ESC1.
Replace long-lived AWS IAM user keys with temporary credentials issued through SSO, then audit and delete every unused access key.
Enable Conditional Access for workload identities, then review application permissions such as Mail.Read, Mail.ReadWrite, Files.Read.All and Chat.Read.All against what each application actually needs. Prefer certificate based authentication over client secrets.
Write down the token revocation procedure and rehearse it including who has the authority to run it at 03:00 on a Sunday.
Count how many alerts your analysts see in a day and how many high severity ones are false positives. If a real detection would be invisible in that volume tuning is the control that matters, not another product.

CISA mapped the full engagement to MITRE ATT&CK Enterprise version 19 and published the technique table in the advisory. Take the techniques that apply to your environment, run them against your own detections and record what your tools actually catch.