CISA Red Team Tests Expose Major Differences Between Two Critical Infrastructure SOCs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published the findings from two simultaneous red team assessments conducted against critical infrastructure organizations, revealing how nearly identical attack techniques can produce dramatically different outcomes depending on an organization's security operations, processes, and response capabilities.

The assessments, detailed in CISA advisory AA26-237A, “A Tale of Two SOCs,” were released on August 25, 2026. CISA evaluated two organizations using similar red team tradecraft but observed a significant difference in how their security teams detected and responded to the activity.

Despite the different defensive responses, both organizations ultimately had weaknesses that allowed the red team to reach sensitive systems and achieve domain-level compromise.

CISA identified the first organization as Organization A, operating in the Government Services and Facilities Sector, and the second as Organization B, operating in the Water and Wastewater Systems Sector.

The assessment demonstrates that having security products, endpoint detection tools, and multiple security operations centers does not automatically translate into effective defense.

CISA's central finding: Security tools are only as effective as the people, processes, and procedures supporting them.

Organization A Was Completely Compromised Without Detection

The red team successfully compromised Organization A's environment without being detected.

The initial access was obtained through a web application that contained default credentials for several built-in accounts.

After gaining access, the red team used the compromised application to send phishing emails from an internal address.

The phishing campaign successfully resulted in payload execution on four workstations.

The attackers then moved deeper into the environment and escalated privileges by abusing two Active Directory weaknesses.

One was the default Machine Account Quota, which allowed ordinary domain users to add machine accounts.

The second involved a misconfigured Active Directory Certificate Services (AD CS) certificate template.

The certificate configuration allowed certificate requests to be made on behalf of other users, providing a path toward elevated privileges and domain compromise.

AD CS Misconfiguration Enabled Privilege Escalation

The certificate-template weakness was an ESC1-style AD CS misconfiguration.

Because the certificate template permitted inappropriate enrollment behavior, the red team was able to abuse the configuration to obtain elevated authentication capabilities.

This demonstrates why organizations running AD CS need to audit certificate templates carefully rather than assuming that the presence of a certificate infrastructure automatically means it is securely configured.

CISA also highlighted the organization's default Machine Account Quota as another important weakness.

When this setting is left at its default configuration, domain users can potentially create new computer accounts, which can become useful during Active Directory attack chains.

Attackers Found Credentials Stored in Cleartext

After obtaining elevated access, the red team discovered credentials stored in insecure locations.

Three sensitive business systems were accessed using credentials found in cleartext.

The exposed credentials included information contained in decrypted database configuration files.

The team also discovered static AWS access keys that had been configured never to expire.

Because these credentials remained valid, they provided attackers with a potentially long-lived method of accessing cloud resources.

CISA highlighted the combination of cleartext credentials and non-expiring cloud credentials as a major security weakness.

Cloud Permissions Allowed Access to Security Team Information

The compromise extended beyond the organization's traditional on-premises environment.

The red team obtained a Primary Refresh Token (PRT) and identified Entra ID applications with excessive permissions.

Some of these applications had permissions that allowed access to email across the organization.

The attackers used these permissions to read the security team's email and determine whether defenders had identified the intrusion.

This created a particularly dangerous situation because the attackers could potentially monitor the organization's own security response while remaining inside the environment.

Thousands of Alerts Hid the Attack

One of the most significant findings was that Organization A actually generated security alerts during the red team operation.

The problem was that defenders were unable to distinguish the important signals from the enormous volume of other alerts.

CISA said the organization generated thousands of false-positive alerts from normal business operations.

Many of those alerts were assigned higher severity levels, making it more difficult for analysts to identify the activity associated with the red team.

Organization A also operated multiple SOCs and endpoint security products, but those systems did not provide sufficient shared visibility.

As a result, analysts lacked a unified picture of what was happening across the environment.

A Real Red Team Alert Was Dismissed

One particularly important example involved activity on a System Center Configuration Manager (SCCM) server.

A security alert associated with the red team was generated, but analysts dismissed it as a false positive because they could not determine who owned the affected system.

This illustrates a key difference between generating an alert and actually responding to an alert.

The organization had detection technology in place, but the supporting processes were not strong enough to turn the signal into an effective investigation.

Major Weaknesses Identified at Organization A

CISA identified several weaknesses that significantly contributed to Organization A's compromise:

• Default Machine Account Quota allowed domain users to create machine accounts.
• Misconfigured AD CS certificate templates enabled certificate abuse and privilege escalation.
• Cleartext credentials were stored on systems accessible to attackers.
• Static AWS credentials were configured without expiration.
• Cloud tokens were not properly revoked.
• Over-permissioned Entra ID applications could access organizational email.
• Multiple SOCs lacked sufficient shared visibility.
• High alert volumes buried potentially important security events.
• Analysts lacked clear escalation procedures.
• Security personnel had limited authority to respond to suspicious activity.

Together, these weaknesses allowed the red team to move from initial access to domain-level compromise without triggering an effective defensive response.

Organization B Responded Within Minutes

Organization B experienced a very different outcome despite facing a similar style of attack.

The red team initially delivered phishing payloads to the organization.

However, Organization B's SOC detected the malicious activity when the payloads were executed.

Security personnel responded quickly by isolating the affected workstations.

The response took between two and 20 minutes depending on the workstation.

By isolating the systems, the SOC prevented the red team from establishing persistent command-and-control communications and significantly limited the ability to expand the initial foothold.

CISA Shifted to an Assume-Breach Scenario

Because the initial foothold was quickly contained, CISA changed the structure of the assessment.

Trusted agents within Organization B executed a red team payload on a designated non-privileged host.

This allowed the assessment to continue under an assume-breach model and provided the red team with access similar to what it would have obtained if the original compromise had succeeded.

This distinction is important.

Organization B's security team did not necessarily prevent every underlying vulnerability from existing.

Instead, it detected and contained the initial attack quickly enough to prevent those weaknesses from being chained together during the original intrusion.

Organization B Had Similar Credential Security Problems

Once the red team was given the assume-breach foothold, it discovered weaknesses similar to those found at Organization A.

One major issue involved a domain service account credential stored in cleartext inside an SCCM configuration file.

The account had significant privileges over a domain controller.

The red team used the credentials to conduct a DCSync attack and retrieve the KRBTGT secret.

This demonstrated that Organization B still had serious identity and credential-management weaknesses even though its SOC had performed much better at detecting the initial attack.

The Red Team Reached the OT Network Boundary

The assessment also demonstrated that the red team could reach a bastion host located within Organization B's operational technology (OT) demilitarized zone.

However, the bastion host did not allow outbound Internet connectivity.

As a result, the red team could not establish an external command-and-control channel.

The assessment team therefore did not gain access to the organization's OT systems themselves.

This network restriction served as an important containment mechanism.

Even after the red team reached the OT boundary, segmentation and outbound connectivity controls prevented the compromise from progressing further.

The Same Attack Techniques Produced Different Results

The contrast between the two organizations was one of the most important findings from the assessment.

Organization A

Initial access → phishing → privilege escalation → domain compromise → sensitive systems → cloud resources → security-team monitoring

The activity was not effectively detected or contained.

Organization B

Initial access → phishing → detection → workstation isolation → C2 blocked

The initial intrusion was contained within minutes.

When CISA later provided an assume-breach foothold, the team found serious security weaknesses, but network and defensive controls prevented it from reaching the OT environment.

The Biggest Difference Was Not the Security Tools

CISA concluded that the most significant difference between the two organizations was not necessarily the security technology deployed.

Instead, the difference came from the people, processes, and procedures operating those technologies.

Organization A had multiple security tools and SOCs but suffered from alert overload, fragmented visibility, unclear escalation procedures, and limited analyst authority.

Organization B's SOC was able to recognize malicious execution and respond rapidly by isolating affected machines.

The assessment therefore highlights an important security principle:

Detection technology is valuable only when security teams can identify important signals, investigate them quickly, and take decisive action.

CISA Recommendations

The findings emphasize several areas that organizations should prioritize.

Review Active Directory Configuration

Organizations should review:

• Machine Account Quota settings
• AD CS certificate templates
• Certificate enrollment permissions
• Privileged accounts
• Domain controller permissions

Particular attention should be given to certificate templates that allow users to request certificates with identities or privileges they should not possess.

Eliminate Cleartext Credentials

Credentials should not be stored in:

• Configuration files
• Database connection strings
• SCCM configuration files
• Scripts
• Shared directories
• Other accessible plaintext locations

Secrets should instead be managed through appropriate credential-management and secret-management mechanisms.

Rotate and Expire Cloud Credentials

Long-lived static cloud access keys create significant risk.

Organizations should minimize the use of permanent credentials, rotate existing keys and use short-lived credentials or tokens wherever possible.

Reduce Excessive Cloud Permissions

Entra ID applications should be reviewed regularly to ensure that they receive only the permissions required for their intended functions.

Applications with organization-wide mailbox or identity permissions deserve particular scrutiny.

Improve SOC Visibility

Security teams should be able to correlate information from endpoint, identity, cloud, network and email security systems.

Fragmented visibility can allow attackers to move between environments without triggering a coherent investigation.

Reduce Alert Noise

Organizations should prioritize improving the quality of alerts rather than simply increasing the number of detections.

Large volumes of false positives can cause analysts to overlook genuine malicious activity.

Establish Clear Escalation Procedures

SOC analysts need clearly defined procedures for:

• Escalating suspicious activity
• Contacting system owners
• Isolating endpoints
• Disabling compromised accounts
• Revoking credentials
• Investigating high-risk alerts

Analysts should also have sufficient authority to act quickly when a compromise is suspected.

Strengthen Network Segmentation

Organization B demonstrated the value of restricting outbound connectivity from sensitive environments.

The inability to establish an external C2 channel from the OT DMZ limited the red team's ability to continue the attack.

Strong segmentation, restricted outbound communications and carefully controlled access between IT and OT environments can significantly reduce the impact of a compromise.

Key Takeaway

CISA's “A Tale of Two SOCs” assessment demonstrates that the existence of security tools does not guarantee effective cybersecurity.

Both organizations contained serious weaknesses, including exposed credentials and Active Directory security issues. However, their defensive outcomes were dramatically different.

Organization A failed to detect and contain the intrusion, allowing the red team to achieve domain-level compromise and access sensitive systems and cloud resources.

Organization B detected the initial attack within minutes, isolated compromised systems and prevented the red team from establishing C2.

The assessment ultimately reinforces a simple but critical lesson: effective cybersecurity depends not only on technology, but also on the people, processes, visibility and response procedures behind that technology.