CISA "A Tale of Two SOCs": Detection and Containment from Two Red Team Assessments

1. Background Information

• Article Title: A Tale of Two SOCs: Insights From Two Red Team Assessments
• Publisher: CISA
• Publication Date: 2026-08-25
• Source: CISA
• Related Technologies, Products, and Datasets: Active Directory, AD CS, SCCM, AWS, Microsoft Entra ID, two red team assessments
• Severity: High (Evaluates practical value for SOC operations and identity foundation improvements rather than an urgent incident)

2. Key Takeaways

In Organization A, the progression from initial compromise to the domain, sensitive business systems, and the cloud proceeded without adequate detection and containment. In contrast, Organization B isolated compromised endpoints within minutes and severed C2.

However, the subsequent deep compromise in Organization B was not the direct continuation of the initial attack chain. Because the initial intrusion was stopped, CISA continued the assessment from a host prepared by a trusted agent using an assume breach model. Therefore, one must not interpret Organization B's initial containment as meaningless simply by looking at the final result that both organizations were ultimately fully domain compromised.

3. Assessment Design and Comparison Caveats

CISA conducted simultaneous assessments using similar red team tactics on Organization A within the Government Services and Facilities Sector and Organization B within the Water and Wastewater Systems Sector. However, the organizations, configurations, and defense postures were not identical, so this was not a controlled A/B test.

For Organization A, the assessment continued from the actual initial intrusion chain through subsequent compromises. For Organization B, because the initial intrusion was quickly detected and isolated, the assessment continued from an assume-breach host simulating the access that would have been obtained if the initial intrusion had not been stopped. This boundary is the most critical factor when reading this article.

4. Organization A: Attack Progression and Defensive Results

1. The red team targeted a web application retaining default credentials to establish access to internal email.
2. Using email addresses obtained from public sources, they conducted phishing to gain initial access to multiple workstations.
3. They enumerated Active Directory using tools such as BloodHound, and escalated privileges by leveraging Machine Account Quota and AD CS ESC1 misconfigurations.
4. They obtained additional access paths from SCCM, various configuration files, and stored credentials.
5. They reached domain administrator privileges, sensitive business systems, and cloud resources, while the SOC failed to adequately contain the activity.

CISA cited high volumes of false positives and daily alerts, a lack of baselines, silos between multiple SOCs and EDRs, and unclear responsibilities and authorities as major defensive issues.

5. Organization B: Initial Containment and Post-Assume-Breach Assessment

1. When the red team attempted an initial intrusion, Organization B's defenders detected the impacted endpoints.
2. Three endpoints were isolated in approximately 10 minutes, 2 minutes, and 20 minutes, respectively, severing initial C2.
3. Because the initial chain could no longer continue, CISA switched to an assume-breach model using a host provided by a trusted agent.
4. From that state, they verified paths leveraging plaintext credentials in SCCM, excessive service account permissions, RBCD, DCSync, and other vectors.
5. Assessments also proceeded toward the cloud and OT DMZ, but outbound C2 from the OT DMZ and suspicious Azure sign-ins were blocked and detected by defenders.

This result does not mean that Organization B was breached from an actual initial intrusion to a full domain compromise. It is the result of separately verifying identity and privilege design weaknesses that remained even after initial containment.

6. Comparison of the Two Organizations

Aspect	Organization A	Organization B
Detection After Initial Intrusion	Progressed without adequate containment	Promptly detected
Endpoint Isolation	Did not reach isolation that stops attack progression	Isolated in approx. 10 min, 2 min, and 20 min
Initial C2	Maintained	Severed
Transition to Deep Assessment	Continued actual intrusion chain	Resumed from assume-breach host
AD / Identity Foundation Weaknesses	Exploitable	Verified exploitable paths after assume-breach
Cloud / OT Side	Reached sensitive data and cloud	Detected and blocked certain suspicious activities again

Crucially, one must separately evaluate the effect of rapid isolation and the identity and cloud design weaknesses that persist even after isolation.

7. Commonly Critical Technical Weaknesses

• Active Directory enumeration and privilege paths.
• Unnecessary allowance for Machine Account Quota.
• Dangerous configurations in certificate templates such as AD CS ESC1.
• Plaintext and decryptable credentials remaining in SCCM and configuration files.
• Excessive permissions granted to service accounts and applications.
• Long-lived cloud credentials and tokens, coupled with a lack of revocation procedures.
• Fragmented investigation and response across IT, cloud, and OT.

8. Lessons for SOC Operations

• Quality Over Volume of Alerts: Without sufficient baselines and tuning, real activity gets buried in daily alerts.
• Empower Responders with Isolation Authority: Organization B's example demonstrates the value of being able to execute endpoint isolation within minutes.
• Do Not End Investigations at Isolation: Stopping initial C2 does not mean existing AD, SCCM, or cloud identity weaknesses are resolved.
• Reduce Silos Between SOCs: EDR, network, cloud, and OT teams must be able to share asset ownership and judgments.
• Establish Cloud Token Response Procedures: Incident response must include the detection, invalidation, and reissue of access and refresh tokens.

9. Priority Improvement Items

1. Maintain normal operation baselines and continuously reduce false positives and low-value alerts.
2. Establish authority and escalation paths that allow the SOC to rapidly execute necessary isolation and containment.
3. Audit Machine Account Quota, AD CS certificate templates, SCCM distributions, and service account privileges.
4. Apply appropriate Conditional Access to workload identities and reduce unnecessary or excessive application permissions.
5. Practice procedures to detect and revoke cloud access and refresh tokens.
6. Continue hunting for compromise paths across AD, cloud, and OT even after endpoint isolation.

10. Required Evidence and Logs

• EDR alert occurrence time, analyst confirmation time, and isolation start and completion times.
• CMDB and asset information linking asset owners, criticality, and normal users.
• Active Directory account, group, and permission modification logs.
• AD CS certificate issuance and template modification records.
• Access records for SCCM distribution points and configuration files.
• Directory access equivalent to DCSync.
• AWS and Microsoft Entra ID sign-ins, application permissions, and token-related audits.
• OT DMZ perimeter communications and isolation records.

11. Facts, Inference, and Hypothesis

Facts

• CISA conducted simultaneous red team assessments using similar tactics across two organizations.
• CISA's Executive Summary concluded that full domain compromise and access to sensitive business and cloud resources were achieved in both environments.
• Organization B rapidly detected and isolated the initial intrusion, prompting CISA to transition to an assume-breach model.
• Organization B's deep assessment continued from a host provided by a trusted agent.
• CISA cited insufficient detection tool tuning, organizational silos, and underestimation of the cloud environment as key lessons.

Inference

• It is appropriate to evaluate Organization B's results separately: "Initial containment succeeded, but identity foundation resilience against post-breach scenarios required additional improvements."
• SOC maturity should not be measured solely by endpoint isolation time, but should also include post-isolation identity and cloud investigations and structural remediation.

Hypothesis

• Japanese enterprises with environments co-locating AD CS, SCCM, Entra ID, and multiple SOCs may harbor similar issues regarding responsibility boundaries, credentials, and privilege paths.

12. MITRE ATT&CK Mapping

Because CISA itself maps assessment activities to ATT&CK, only representative examples confirmed to have been executed during the article are listed.

ID	Technique	Confidence	Basis
T1566.002	Phishing: Spearphishing Link	High	Used phishing for initial access.
T1649	Steal or Forge Authentication Certificates	High	Exploited dangerous certificate templates in AD CS.
T1552.001	Unsecured Credentials: Credentials In Files	High	Acquired credentials from configuration files and SCCM-related files.
T1003.006	OS Credential Dumping: DCSync	High	Performed during Organization B's assume-breach assessment.

Even if there is a possibility of creating a Golden Ticket from acquired krbtgt, do not add it as a separate technique if actual creation and usage are not confirmed in the article.

13. Constraints and Uncertainties

• Because the two organizations were not controlled subjects with identical configurations and personnel, comparisons based solely on response time are not feasible.
• Organization B transitioned to assume-breach after initial containment, so it was not evaluated whether the same depth could have been reached continuously from an actual initial intrusion.
• Post-remediation reassessment results and long-term improvement effects cannot be confirmed from the public article.

14. Impact on SOCs and Organizations

Many points can be directly applied to Japanese enterprises using AD, AD CS, SCCM, AWS, and Microsoft Entra ID in combination. In particular, treating not only "isolation SLAs" but also alert owners, isolation authority, AD CS/SCCM configurations, workload identities, and cloud token revocation as a single investigation and improvement loop holds high value.

15. Summary by Target Audience

• For SOCs: Maintain a capability to execute endpoint isolation within minutes while continuing to hunt for compromise paths targeting AD, SCCM, cloud IDs, and OT even after isolation. Do not misread Organization B's deep compromise as an actual intrusion.
• For Administrators: Prioritize auditing MAQ, AD CS, stored SCCM credentials, service accounts, application permissions, and long-lived cloud credentials.
• For Users: Early reporting of suspicious emails contributes to containing initial intrusions, but ultimate defense also requires organizational improvements to identity and privilege design.