In August 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released results from two red team assessments conducted at the same time. While the agency said the teams used similar tradecraft, the defensive outcomes were strikingly different: one organization detected and contained activity quickly, while the other reported effectively no detection at all.
The advisory, tracked as AA26-237A and titled “A Tale of Two SOCs,” focused on how operational readiness, tooling, and internal coordination can determine whether an intrusion is stopped or allowed to expand—even when the attack path looks similar.
Two simultaneous assessments, two very different SOC outcomes
CISA ran both engagements against organizations in critical infrastructure sectors. For confidentiality, the first target was described as a Government Services and Facilities Sector organization (Organization A). The second was a Water and Wastewater Systems Sector organization (Organization B).
According to the advisory, both red teams achieved full compromise at the domain level. In both cases, the attackers also reached sensitive business systems (SBSs) and cloud resources. The difference was not whether the attacker could get in—it was how quickly defenders saw the activity and how effectively they disrupted it.
CISA summarized the core comparison plainly: the red team used similar methods in both assessments but observed different defensive responses.
Organization A: No detection despite full compromise
For Organization A, CISA described an initial foothold that began with a web application exposing default credentials for several built-in accounts. With those credentials, the red team was able to send phishing emails from an internal address and reach four workstations.
After establishing that entry point, the attackers escalated privileges by combining two weaknesses: a default Machine Account Quota configuration and a misconfigured Active Directory Certificate Services (AD CS) template. CISA highlighted this template abuse as part of the same general class of problems that has been seen in connection with domain takeover techniques such as Certighost.
From there, the red team moved into sensitive business systems. CISA reported that attackers used credentials stored in cleartext, including decrypted database configuration files and static Amazon Web Services (AWS) access keys that were set to never expire.
In cloud, the attackers stole a Primary Refresh Token and abused Entra ID applications with elevated permissions to access security team email data and check whether defenders were aware of the activity.
Why defenders missed it
Despite the scale of the intrusion, CISA said Organization A did not detect the activity. The reasons were primarily operational and process-related:
- Thousands of false-positive alerts generated by normal business operations, many rated higher severity, obscured alerts tied to the red team.
- The organization operated multiple SOCs and endpoint tools, but there was no shared visibility across teams.
- Analysts lacked clear escalation procedures and had limited authority to act.
- A real alert related to red team activity on a System Center Configuration Manager (SCCM) server was dismissed as a false positive because defenders could not identify the system owner.
CISA’s framing pointed to a key theme: security visibility is only useful when alerts are trustworthy, triage is consistent, and teams can escalate and respond quickly.
Organization B: Detection and containment disrupted spread
Organization B was attacked using the same overall style of approach, but the defensive outcome differed. CISA reported that its SOC detected the initial phishing payloads as they executed and then isolated affected workstations within 2 to 20 minutes. That action interrupted command-and-control (C2) communications before the intrusion could widen.
Because that initial foothold was severed, CISA described how its trusted agents carried out a different step. Instead of letting the red team pursue the original path, the engagement shifted toward an assume-breach model: a red team payload executed on a designated non-privileged host to replicate the access the team would otherwise have gained.
Same underlying weaknesses, different initial stop
Even with improved early detection, CISA said the engagement still uncovered serious issues. The red team found the same general problems, including:
- Cleartext credentials for a domain service account in an SCCM configuration file that had rights over a domain controller.
- Use of those rights to perform a DCSync attack and retrieve the krbtgt secret.
The attackers also reached a bastion host in Organization B’s operational technology (OT) demilitarized zone. However, the host blocked outbound internet access, so no C2 channel was established, and the team did not move into OT systems themselves.
In short, Organization B demonstrated that rapid detection and containment can limit early spread and hinder attacker control of the environment. Yet the advisory also made clear that once core identity and credential weaknesses exist, recovery and monitoring still have to address deeper compromise paths.
What enabled compromise in both organizations
CISA listed multiple weaknesses that served as primary enablers across the engagements. While implementation details differed, the pattern was consistent: misconfigurations and exposed secrets created repeatable escalation and access opportunities.
- Machine Account Quota left at default, enabling domain users to add machine accounts.
- AD CS certificate templates misconfigured, allowing certificate requests by any user (CISA referenced ESC1).
- Cleartext credentials for service and database accounts stored on systems reachable from the network.
- Static cloud access keys set never to expire, without token revocation safeguards.
- Over-permissioned Entra ID applications capable of reading mail across all users.
These weaknesses are not merely technical. They also reflect governance gaps: default settings persisted, secrets were stored without protection, and access scopes were broad enough to turn a foothold into a full compromise.
People and procedures mattered as much as tools
Perhaps the most actionable message in the advisory is not about a single exploit chain. Instead, CISA emphasized that the difference between the two outcomes came down to how people, processes, and procedures supported defensive tools.
CISA stated that detection tools are only as effective as the people and workflows operating them. In Organization A, alert quality and coordination failed defenders. In Organization B, detection occurred early enough to isolate workstations and disrupt C2.
That contrast suggests a practical takeaway for defenders: improving detection is more than adding sensors. It requires alert tuning, shared visibility between teams, escalation paths with clear authority, and the ability to validate whether an alert is tied to business-as-usual activity or something that needs immediate action.
Conclusion: Two SOCs, one lesson
The CISA red team findings from AA26-237A show a difficult reality. Even when defenders face similar attack tradecraft, outcomes can diverge sharply based on how well security operations detect, triage, and respond. Organization A’s environment lacked effective coordination and clear escalation, resulting in no meaningful detection despite deep compromise. Organization B detected the early stage and contained it quickly, limiting attacker control and spread.
Meanwhile, the common weaknesses across both engagements reinforce a second lesson: strong identity and secret-handling practices are foundational. If credentials are exposed in cleartext, certificate services are misconfigured, and cloud keys never rotate, attackers can often convert detection wins into temporary delays rather than full prevention.
Source: https://thehackernews.com/2026/08/cisa-red-team-compromised-two-critical.html
