CISA red team assessments of two critical infrastructure orgs: both fully compromised, but only one detected and contained the intrusion

Linha do tempo

1. cisa.gov ↗ · pub. 20/08/2026 13:32 · coletado 19/10 18:37 primeiro registro

   CISA red team assessments of two critical infrastructure orgs: both fully compromised, but only one detected and contained the intrusion

   ler a análise desta fonte ocultar

   CISA ran concurrent red team assessments at two organizations: Organization A (Government Services and Facilities) and Organization B (Water and Wastewater Systems). Both reached full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A did not detect or contain the activity. Organization B detected the initial compromise and isolated affected hosts, which forced the red team into an assume breach model. Organization B's defenders also detected and isolated the red team's activity on an OT DMZ bastion host. The advisory, published with the assessed organizations, sets out lessons learned and mitigations for IT, cloud and OT environments. The article text provided is truncated, so the later sections (including the full Mitigations and ATT&CK table) are not covered.

   Technical Details

   • Org A initial access: a web application with default credentials [T1589.001] let the team send email from an internal address. The resulting phishing [T1566] compromised four workstations.
   • Org A privilege escalation: a modified BloodHound collector, customized to evade EDR signatures, enumerated Active Directory [T1087.002, T1018, T1069.002, T1615]. The default Machine Account Quota of 10 allowed machine account creation [T1136.002]. Misconfigured ADCS templates (ESC1) allowed certificate requests for arbitrary users [T1649].
   • Org A SBS access: the team enumerated SCCM user-device relationships [T1033] and moved laterally to the target users' workstations. It then found cleartext credentials [T1552], decrypted SQL developer tool files (connections.json, product-preferences.xml) [T1552.001], and obtained long-lived static AWS IAM keys that were never rotated. Compromising the root DFS drive exposed the local files of thousands of virtual desktops. Tools were proxied through compromised workstations [T1090.001].
   • Org A cloud compromise: the team used AzureHound and ROADrecon [T1526, T1588.002] to find Entra ID applications with elevated Microsoft Graph Application permissions. It then stole the application owner's Primary Refresh Token, added a client secret to the application, and impersonated it [T1550.001] to read email [T1114]. Conditional Access for workload identities would have mitigated this, but the red team never saw it in use.
   • Org A SOC failures: the team read SOC staff email and used screenshots [T1113], keyloggers [T1056.001] and Teams messages [T1213.005] on SOC workstations. Medium and low EDR alerts went unanswered, buried under thousands of false positives. Multiple siloed SOCs and EDR tools, no escalation SOPs and limited staff authority compounded the problem.
   • Org B initial access: spearphishing using addresses gathered from public websites [T1589.002]. Three users clicked [T1204]. Each payload triggered a medium-severity alert ("An executable file loaded an unexpected DLL file"), and SOC staff isolated all three hosts within 10, 2 and 20 minutes.
   • Org B escalation: from the assume breach host, the team abused MAQ to create a machine account with a hostname resembling a legitimate host. A cleartext service account credential in an XML file on an SCCM distribution point led to AllExtendedRights over a domain controller. Resource-based constrained delegation then gave DCSync [T1003.006], including the krbtgt account. Kerberos ticket abuse [T1558] gave access to an SBS web server.
   • Org B OT and cloud: FTP credentials were used to log in over SSH [T1021.004] to an OT DMZ bastion host. The host blocked outbound C2, and payload execution triggered an alert that led to quarantine. In the cloud, ADConnectDump [T1003] yielded the MSOL and Entra ID Sync account credentials. The Sync account had no MFA, but its interactive login triggered a Microsoft alert and the SOC blocked it. The team also abused Seamless SSO (AZURESSO computer account) with Rubeus asktgs tickets, but MFA limited the access.

   Remediation

   • Establish and continuously maintain a baseline, and reduce alert noise through tuning.
   • Break down organizational silos and empower network defenders with clear escalation authority.
   • Implement Conditional Access policies for workload identities and monitor for excessive or unused permissions.
   • Establish and regularly review procedures to detect, remediate and revoke access and refresh tokens after a cloud compromise.