CISA "A Tale of Two SOCs": Detection and Containment from Two Red Team Assessments

1. Basic Information

• Article Title: A Tale of Two SOCs: Insights From Two Red Team Assessments
• Publisher: CISA
• Publication Date: 2026-08-25
• Original Source: CISA
• Related Information Source: CISA PDF
• Related Technologies, Products, and Datasets: Active Directory, AD CS, SCCM, AWS, Microsoft Entra ID, Two Red Team Assessments
• Priority: High (Evaluates practical value for SOC operations and identity infrastructure improvement, rather than an emergency incident)
• Report Type: defense_research / comparative_assessment

2. Key Takeaways

In Organization A, the attack progressed from the initial compromise to the domain, sensitive business systems, and the cloud without sufficient detection or containment. In contrast, Organization B isolated the initially compromised endpoints within minutes and severed the C2 connection.

However, the subsequent deep compromise in Organization B was not a direct continuation of the initial attack chain. Because the initial intrusion was stopped, CISA continued the assessment using an assume-breach model from a host provided by a trusted agent. Therefore, readers must not interpret the result "both organizations ultimately suffered full domain compromise" as meaning that Organization B's initial containment was meaningless.

3. Assessment Design and Comparison Caveats

CISA conducted simultaneous assessments using similar red team techniques on Organization A (from the Government Services and Facilities Sector) and Organization B (from the Water and Wastewater Systems Sector). However, the organizations, configurations, and defenses were not identical, meaning this was not a controlled A/B test.

For Organization A, the assessment continued from the actual initial intrusion chain through subsequent compromises. For Organization B, because the initial intrusion was quickly detected and isolated, the assessment continued from an assume-breach host that simulated "the access that would have been gained if the initial intrusion could not be stopped." This distinction is the most important point when reading this article.

4. Organization A: Attack Progression and Defensive Results

1. The red team started from a web application with leftover default credentials and gained the ability to use internal email.
2. They used email addresses obtained from public sources to conduct phishing, gaining initial access to multiple workstations.
3. They enumerated Active Directory using tools like BloodHound and escalated privileges by exploiting Machine Account Quota and AD CS ESC1 misconfigurations.
4. They obtained additional access paths from SCCM, various configuration files, and saved credentials.
5. They reached domain administrator privileges, sensitive business systems, and cloud resources, but the SOC failed to contain them properly.

CISA cited high false positives and daily alert volumes, lack of baselines, silos between multiple SOCs/EDRs, and unclear responsibilities and authorities as major defensive problems.

5. Organization B: Initial Containment and Post-Assume-Breach Assessment

1. When the red team attempted the initial intrusion, Organization B's defenders detected the affected endpoints.
2. The three endpoints were isolated in approximately 10 minutes, 2 minutes, and 20 minutes, respectively, and the initial C2 was severed.
3. Because the initial chain could not continue, CISA switched to an assume-breach model using a host provided by a trusted agent.
4. From that state, they identified paths to use plaintext credentials in SCCM, excessive service account privileges, RBCD, and DCSync.
5. The assessment also progressed toward the cloud and OT DMZ, but outbound C2 from the OT DMZ and suspicious sign-ins in Azure were blocked and detected by the defenders.

This result does not mean that "Organization B was breached all the way from the actual initial intrusion to a full domain compromise." It is the result of separately verifying identity and privilege design weaknesses that still existed after initial containment.

6. Comparison of the Two Organizations

The key is to separately evaluate the effectiveness of rapid isolation and the identity and cloud design weaknesses that remain even after isolation.

7. Common Technical Weaknesses

• Active Directory enumeration and privilege paths.
• Unnecessary allowance for Machine Account Quota.
• Dangerous certificate template configurations such as AD CS ESC1.
• Plaintext or recoverable credentials left in SCCM and configuration files.
• Excessive privileges granted to service accounts and applications.
• Long-lived cloud credentials and tokens, along with a lack of revocation procedures.
• Fragmented investigation and response across IT, cloud, and OT environments.

8. Lessons for SOC Operations

• Quality Over Alert Volume: Without proper baselines and tuning, real activity gets buried in daily alerts.
• Empower Teams with Isolation Authorities: Organization B's example shows the value of being able to execute endpoint isolation within minutes.
• Do Not End Investigations at Isolation: Stopping initial C2 does not fix existing AD, SCCM, or cloud identity weaknesses.
• Reduce SOC Silos: EDR, network, cloud, and OT teams must be able to share asset ownership and decisions.
• Standardize Cloud Token Response: Incident response must include the detection, revocation, and reissuance of access and refresh tokens.

9. Priority Improvement Items

1. Maintain normal operation baselines and continuously reduce false positives and low-value alerts.
2. Establish authorities and escalation paths so the SOC can quickly execute necessary isolation and containment.
3. Audit Machine Account Quota, AD CS certificate templates, SCCM distributions, and service account privileges.
4. Apply appropriate Conditional Access to workload identities and reduce unnecessary or excessive application privileges.
5. Practice procedures to detect and revoke cloud access and refresh tokens.
6. Continue hunting for compromise paths involving AD, cloud, and OT even after endpoint isolation.

10. Required Evidence and Logs

• EDR alert generation time, analyst review time, and isolation start and completion times.
• CMDB and asset information linking asset owners, criticality, and normal users.
• Active Directory account, group, and privilege change logs.
• AD CS certificate issuance and template change records.
• Access records for SCCM distribution points and configuration files.
• Directory access equivalent to DCSync.
• AWS and Microsoft Entra ID sign-ins, app permissions, and token-related audits.
• OT DMZ perimeter communications and isolation records.

11. Facts / Inference / Hypothesis

Facts

• CISA conducted simultaneous red team assessments using similar techniques across two organizations.
• CISA's Executive Summary concluded that both environments achieved full domain compromise and access to sensitive business and cloud resources.
• Organization B quickly detected and isolated the initial intrusion, forcing the red team to transition to an assume-breach model.
• Organization B's deep assessment continued from a host provided by a trusted agent.
• CISA cited poor detection tool tuning, organizational silos, and underestimation of cloud environments as key lessons.

Inference

• It is appropriate to evaluate Organization B's results separately: "Initial containment succeeded, but identity infrastructure resilience against post-breach scenarios has additional challenges."
• SOC maturity should not be measured solely by endpoint isolation time, but should also include post-isolation identity/cloud investigations and structural remediation.

Hypothesis

• Similar environments using AD, AD CS, SCCM, AWS, Microsoft Entra ID, and multiple SOCs may still harbor issues related to responsibility boundaries, credentials, and privilege paths.

12. MITRE ATT&CK Mapping

Because CISA mapped its own assessment activities to ATT&CK, only representative examples confirmed in the article are listed here.

• T1566.002 Phishing: Spearphishing Link (High): Used phishing for initial access.
• T1649 Steal or Forge Authentication Certificates (High): Exploited dangerous AD CS certificate templates.
• T1552.001 Unsecured Credentials: Credentials In Files (High): Retrieved credentials from configuration files and SCCM-related files.
• T1003.006 OS Credential Dumping: DCSync (High): Performed during Organization B's assume-breach evaluation.

Even if obtaining krbtgt creates the possibility of forging a Golden Ticket, it is not added as a separate technique unless actual creation and use are confirmed in the article.

13. Constraints and Unknowns

• Because the two organizations did not have identical configurations and staff, a comparison based solely on response time is not possible.
• Organization B transitioned to assume-breach after initial containment, so the assessment did not evaluate whether the same depth could have been reached continuously from the actual initial intrusion.
• The public article does not confirm post-remediation reassessment results or long-term improvement effects.

14. Impact on SOCs

Many findings apply generally to organizations using AD, AD CS, SCCM, AWS, and Microsoft Entra ID. It is especially valuable to treat "isolation SLAs" not in isolation, but as part of a single investigation and improvement loop that includes alert ownership, isolation authority, AD CS/SCCM configurations, workload identities, and cloud token revocation.

15. Summary by Target Audience

• For SOCs: Maintain the capability to execute endpoint isolation in minutes, while continuing to hunt for compromise paths to AD, SCCM, cloud IDs, and OT even after isolation. Do not misread Organization B's deep compromise as anything other than an assume-breach assessment.
• For Administrators: Prioritize the audit of MAQ, AD CS, stored SCCM credentials, service accounts, app permissions, and long-lived cloud credentials.
• For End Users: Early reporting of suspicious emails helps contain initial intrusions, but ultimate defense also requires organizational improvements to identity and privilege design.