A Tale of Two SOCs: Insights From Two Red Team Assessments (2026-08-25)

What Happened

CISA tested the security defenses of two organizations by running simulated cyberattacks against them. In both cases, the testing team was able to gain deep access to the organizations' computer networks and cloud systems. One organization (Organization A) failed to notice the attack because their security alerts were too noisy and their security teams did not communicate well with each other. The other organization (Organization B) quickly spotted the attack, isolated the affected computers, and blocked the attackers. Both organizations had weak security settings in their Microsoft cloud environments that let the testers read everyone's emails. Organizations should tune their security alerts, break down communication barriers between teams, and tighten cloud security settings to prevent real attackers from doing the same thing.

Key Takeaways

• CISA conducted simultaneous red team assessments at two organizations; both achieved full domain compromise but Organization B detected and contained initial access while Organization A did not.
• Untuned EDR alerts and organizational silos at Organization A allowed the red team to operate undetected, access SOC emails, and capture screenshots and keylogs from SOC workstations.
• Both organizations had excessive Microsoft Entra ID application permissions and lacked Conditional Access policies for workload identities, enabling the red team to read all user emails via compromised application tokens.
• ADCS ESC1 misconfiguration and default Machine Account Quota values were exploited for privilege escalation and lateral movement in both organizations.
• Organization B demonstrated mature detection by triaging medium-severity EDR alerts within minutes, isolating affected hosts, and blocking suspicious cloud logins triggered by automated Microsoft alerts.

Affected Systems

• Microsoft Active Directory Domain Services
• Microsoft Active Directory Certificate Services (ADCS)
• Microsoft Entra ID (formerly Azure AD)
• Microsoft System Center Configuration Manager (SCCM)
• Amazon Web Services (AWS) IAM
• Windows workstations and servers
• Operational Technology (OT) networks and bastion hosts
• Microsoft 365 services (Outlook, Teams, OneDrive)

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Red team sent phishing emails from an internal email account (Org A) or external spearphishing emails (Org B) to gain workstation access
2. Discovery: Modified BloodHound collector used to enumerate Active Directory users, computers, groups, ACLs, GPOs, and ADCS certificate templates
3. Privilege Escalation: Exploited misconfigured MAQ to create machine accounts, then abused ADCS ESC1 templates (Org A) or found cleartext service account credentials with AllExtendedRights over a DC (Org B) to achieve DCSync
4. Lateral Movement: Used DCSync credentials, Kerberos tickets, and proxied tooling through compromised workstations to access SBSs, SCCM servers, and DFS root drives
5. Cloud Compromise: Abused Entra ID application permissions by stealing PRTs (Org A) or exploiting Seamless SSO and disabled AD-synced accounts (Org B) to add client secrets and read all user emails
6. Collection: Accessed SOC staff emails, captured screenshots, deployed keyloggers, and retrieved Microsoft Teams messages from SOC workstations (Org A)

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The advisory does not provide detection rules. It describes defensive measures and responses observed during the red team assessments, including EDR alerts for unexpected DLL loading and Microsoft Entra ID automated alerts for suspicious sign-ins and API traffic.

Detection Engineering Assessment

Required Log Sources

• EDR process execution and DLL loading alerts
• Microsoft Entra ID sign-in logs and risk detections
• Microsoft Graph API audit logs
• Active Directory object creation logs (Event ID 4741)
• ADCS certificate request logs
• SCCM administrative action logs
• DNS resolution logs for C2 infrastructure
• OT network segmentation firewall logs

Hunting Hypotheses

Control Gaps

• Untuned EDR alerts generating excessive false positives that obscure genuine threats
• Lack of Conditional Access policies for workload identities in Entra ID
• Absence of processes for revoking compromised access and refresh tokens in cloud environments
• ADCS templates with ESC1 misconfiguration allowing low-privileged users to request certificates on behalf of any user
• Default or excessive Machine Account Quota settings allowing non-administrative users to create domain machine accounts
• Service accounts with AllExtendedRights over domain controllers enabling DCSync attacks
• Cleartext credentials stored on workstations, network shares, and configuration files
• SCCM servers lacking additional security controls despite being Tier 0 assets
• Disabled AD-synced accounts with excessive Entra ID application permissions that can be re-enabled by domain compromise
• MSOL synchronization accounts without MFA enabled and capable of interactive Azure portal login

Key Behavioral Indicators

• Medium-severity EDR alert for executable loading unexpected DLL files (observed by Organization B)
• Microsoft Entra ID automated alert for unfamiliar sign-in properties on synchronization accounts
• Microsoft Entra ID alert for suspicious API traffic matching AzureHound user agent
• Accounts exceeding predefined request thresholds to Microsoft Graph API
• Machine account creation events from non-administrative user contexts
• ADCS certificate requests with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled
• New client secrets added to existing Entra ID applications with elevated Graph permissions
• Kerberos service ticket requests for AZURESSO computer accounts from non-standard hosts

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider implementing Conditional Access policies for workload identities in Microsoft Entra ID to extend access controls to service principals and applications.
• Evaluate whether your organization has established procedures for detecting, remediating, and revoking compromised access and refresh tokens in cloud environments.
• Consider treating SCCM and other endpoint configuration managers as high-value assets with additional monitoring and network segmentation.
• If your organization operates OT networks, consider reviewing IT/OT segmentation controls and ensuring bastion hosts block outbound internet connections and require MFA.
• Consider replacing long-lived AWS IAM user credentials with temporary credentials via SSO and IAM role assumption, and audit for any remaining static access keys.
• Evaluate whether your organization has processes to regularly audit Active Directory permissions for misconfigurations and excessively privileged service accounts.

User Protection

• Consider scanning network shares and workstations for plaintext credentials and enforcing policies prohibiting plaintext password storage.
• If your organization uses virtual desktops synchronized with DFS root drives, consider evaluating whether credential files on those virtual desktops are accessible to users without active sessions.
• Consider implementing phishing-resistant MFA for all user, administrative, and privileged accounts in cloud platforms.
• Consider using designated administrative workstations separate from standard user workstations to reduce the impact of credential theft from user endpoints.
• If supported by your tooling, consider implementing just-in-time access for privileged accounts to replace standing administrative rights with temporary, time-bound privilege elevations.

Security Awareness

• Consider incorporating training on secure password storage practices and the risks of storing credentials in plaintext configuration files.
• If your organization has multiple SOC teams or security tool deployments, consider conducting joint exercises to break down communication silos and improve cross-team coordination.
• Consider developing and communicating policies that clarify defender authorities for taking containment actions such as isolating systems without excessive approval requirements.
• Consider conducting simulated incident response exercises to validate that escalation procedures are understood and that defenders know their authorities during incidents.

MITRE ATT&CK Mapping

Additional IOCs

• File Paths:
  • connections.json - SQL Developer tool configuration file containing encrypted database credentials, found on targeted user workstations at Organization A.
  • product-preferences.xml - SQL Developer tool configuration file containing encrypted database credentials, found on targeted user workstations at Organization A.