CISA Red Team Fully Compromised Two Critical Infrastructure Organizations, but Only One SOC Noticed

CISA ran simultaneous red team assessments at two critical infrastructure organizations using similar tradecraft and got very different results. In an advisory released Aug. 25, AA26-237A, “A Tale of Two SOCs,” CISA reports that its red team achieved full domain compromise and reached sensitive business systems and cloud resources at both. One organization never detected or contained the activity. The other caught the initial compromise within minutes.

Organization A: compromised undetected

At a Government Services and Facilities Sector organization, the red team found a web application with default credentials on built-in accounts that let it send email from an internal address. Phishing from that address gave it access to four workstations. It then exploited ESC1-misconfigured Active Directory Certificate Services templates, found cleartext credentials on administrators’ workstations, and abused Entra ID applications with broad application permissions. It went on to read SOC staff email to check whether defenders knew about the intrusion.

The SOC did receive medium- and low-severity EDR alerts but didn’t act on them. Thousands of false positives from normal business operations, many of them higher severity, buried the real alerts. The organization had multiple SOCs and multiple EDR products, and staff didn’t share visibility or talk to system owners. In one exchange, defenders couldn’t identify the owner of an SCCM server and eventually marked the alert a false positive.

Organization B: caught in minutes

At a Water and Wastewater Systems Sector organization, three users clicked phishing links. Each payload triggered a medium-severity alert, and SOC staff isolated the three workstations within 10, 2 and 20 minutes, cutting off command and control. CISA then switched to an assume-breach model with access provided by trusted agents. From there the red team reached sensitive systems and the cloud, including by pulling credentials from the Entra ID Connect sync server. When it reached a bastion host in the OT demilitarized zone, defenders detected the activity and isolated that system too.

CISA’s lessons

“Detection tools are only as effective as the people, processes, and procedures supporting them,” the advisory says. CISA’s recommendations:

• Establish baselines and tune detections to cut alert noise.
• Break down silos between SOC teams and system owners, and give defenders the authority to act.
• Apply Conditional Access policies to workload identities and watch for excessive or unused permissions.
• Keep tested procedures for revoking access and refresh tokens after a cloud compromise.

The basics that enabled the intrusions also deserve attention: default credentials, ADCS template configuration and cleartext credentials left on workstations. The advisory maps the red team’s activity to MITRE ATT&CK techniques for teams that want to test their own detections.