A Tale of Two SOCs: Insights From Two Red Team Assessments

Executive Summary

The Cybersecurity and Infrastructure Security Agency (CISA) performed concurrent red‑team assessments on two critical‑infrastructure organizations, both of which suffered full domain compromise and exposure of sensitive business systems and cloud assets. Organization A’s detection stack failed to surface the intrusion, while Organization B identified the initial foothold within minutes, isolated compromised hosts, and forced the adversary into an “assume breach” posture. Decision‑makers must now prioritize immediate hardening of detection baselines, cross‑team response authority, and cloud‑security governance to prevent repeat compromise.

Verified Facts

• CISA conducted simultaneous red‑team assessments at two organizations and achieved full domain compromise in both environments — CISA Advisory.
• Organization A did not detect or contain the red‑team activity; Organization B detected initial compromise attempts, isolated affected systems, and forced the red team into an assume‑breach model — CISA Advisory.
• The red team accessed sensitive business systems (SBSs) and cloud resources in both organizations — CISA Advisory.
• Untuned detection tools, lack of baselines, and alert overload were identified as primary reasons for missed threats — CISA Advisory.
• Organizational silos, bureaucratic hurdles, and unclear responder authority impeded effective incident response — CISA Advisory.
• Cloud environments were described as an underestimated risk area by the assessed organizations — CISA Advisory.

Threat Classification

Threat Type: Simulated Red‑Team Attack (adversary‑emulated intrusion) — HIGH CONFIDENCE. Affected Sectors: Critical infrastructure, including IT and OT environments — MEDIUM CONFIDENCE. Geographic Scope: United States (CISA‑mandated assessments) — HIGH CONFIDENCE. Exploitation Status: Active (red‑team successfully compromised domains during the assessment) — HIGH CONFIDENCE. Attacker Motivation: Validation of defensive gaps and testing of response processes (as defined by the assessment scope) — HIGH CONFIDENCE.

Threat Severity Assessment

• Exploitability: Red team achieved full domain compromise using undisclosed techniques, indicating high exploitability of existing gaps — HIGH CONFIDENCE.
• Scope of Impact: Both IT and cloud assets were accessed, demonstrating broad impact across enterprise layers — HIGH CONFIDENCE.
• Prevalence: The advisory highlights that untuned detection and siloed response are common across critical‑infrastructure entities — MEDIUM CONFIDENCE.
• Regulatory Exposure: Failure to detect compromises can trigger NIS2 and DORA penalties, elevating severity — MEDIUM CONFIDENCE.

Business Impact

• Operational Disruption: Full domain compromise can halt production lines in OT environments, leading to downtime measured in hours to days.
• Regulatory Liability: Under NIS2 and DORA, undisclosed breaches of critical infrastructure may incur fines up to €10 million or 2 % of global turnover, plus mandatory breach notifications.
• Financial Exposure: Loss of intellectual property and remediation costs for cloud resource exfiltration can exceed $5 million for midsize utilities.
• Reputational Damage: Public disclosure of a domain‑level breach erodes stakeholder trust and can trigger contract penalties with downstream partners.

Technical Analysis

• Attack Vector: Red‑team leveraged undisclosed initial access techniques to obtain domain credentials, enabling lateral movement.
• Exploitation Chain: Credential acquisition → Domain controller compromise → Access to Sensitive Business Systems (SBS) → Cloud resource enumeration and access.
• Affected Components: Active Directory domain controllers, on‑premises SBS servers, cloud management consoles (e.g., Azure AD, AWS IAM).
• Root Cause/Vulnerability Class: Lack of tuned detection baselines and insufficient alert filtering, leading to blind spots for privileged credential use — a classic “Detection Gap” rather than a software flaw.

MITRE ATT&CK Mapping

• Initial Access → T1078 Valid Accounts — Red team obtained domain credentials to gain foothold.
• Lateral Movement → T1021 Remote Services — Movement across on‑premises and cloud assets after domain compromise.
• Credential Access → T1555 Credentials from Password Stores — Implied by domain credential theft.
• Impact → T1489 Impact — Full domain compromise forced defenders into an assume‑breach posture.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for hunt rule development:

• Unusual privileged account logons from atypical geographic locations or workstations.
• Creation of new cloud service principals or IAM roles without documented business justification.
• Mass enumeration of Azure AD or AWS IAM objects within a short time window.
• Sudden spikes in SMB/LDAP traffic between domain controllers and non‑standard endpoints.

Detection Engineering Guidance

• Collect Windows Security Event ID 4624 (logon) and 4625 (failed logon) with Logon Type 2/10; flag logons for privileged accounts from new source IPs.
• Enable Sysmon Event ID 1 (process creation) and 10 (network connection); alert on processes spawning PowerShell with encoded commands originating from domain controllers.
• Ingest Azure AD sign‑in logs and AWS CloudTrail events; generate alerts on creation of service principals, role assignments, or policy changes outside approved change windows.
• Monitor NetFlow for lateral movement patterns: SMB (port 445) or LDAP (port 389) traffic between domain controllers and low‑value hosts.
• Correlate alerts across these sources in a SIEM (Splunk, Elastic, Sentinel) to trigger a “Domain Compromise” rule when ≥3 distinct indicators appear within 15 minutes.

Sigma Rules

title: New Privileged Account Creation in Azure AD
id: 3f9c2d1e-8b4a-4f6e-9d3a-2c7e5b1a9f6d
status: stable
description: Detect creation of a new Azure AD user with Global Administrator role, indicating possible credential abuse.
logsource:
    product: azure
    service: activitylog
detection:
    selection:
        operationName: Add member to role
        properties.roleName|contains: 'Global Administrator'
    filter:
        - properties.initiatedBy.user.userPrincipalName|contains: 'serviceaccount'
    condition: selection and not filter
falsepositives:
    - Legitimate onboarding of new administrators
level: high
tags:
    - attack.t1078

Threat Hunting Queries

• Hypothesis: Privileged accounts are being used from anomalous workstations — Source: Windows Security Event logs (EventID 4624, LogonType 2) where AccountName is in Domain Admins and WorkstationName not in known asset list.
• Hypothesis: New cloud service principals are created without ticketed change — Source: Azure AD Activity Log where operationName = "Add member to role" and roleName = "Global Administrator".
• Hypothesis: Sudden surge in LDAP queries from non‑domain controllers — Source: Network flow logs filtering dstPort 389 and srcIP not in DC list, count > 100 per minute.
• Hypothesis: PowerShell processes with base64‑encoded commands launched from domain controller hosts — Source: Sysmon Event ID 1 where Image = "*\powershell.exe" and CommandLine contains "-EncodedCommand".
• Hypothesis: Unusual SMB traffic to cloud‑connected VMs indicating lateral movement — Source: NetFlow where dstPort 445 and srcIP in on‑prem network, dstIP in cloud subnet, bytes transferred > 1 GB in 1 hour.

SOC Analyst Playbook

• P0 – Immediate (0‑1 hr): Pull Windows Security Event 4624 for privileged accounts; isolate any host showing a new privileged logon from an unknown source.
• P0 – Immediate (0‑1 hr): Query Azure AD Activity Log for Global Administrator role additions; if found, disable the newly created account and trigger IR.
• P1 – Urgent (1‑4 hr): Review Sysmon Event 1 for PowerShell processes with encoded commands on domain controllers; terminate suspicious processes and capture memory.
• P1 – Urgent (1‑4 hr): Export CloudTrail/Azure AD audit logs for the past 24 hrs; identify any IAM role changes and revert unauthorized modifications.
• P2 – Same‑day (4‑24 hr): Conduct a full domain controller health check (repadmin /showrepl, dcdiag); document any replication anomalies.
• P2 – Same‑day (4‑24 hr): Update detection rule baselines to include newly observed IOC patterns; validate rule firing in test environment.

Executive Decision Matrix

🔗 Related Intelligence Reports

• Related topic: CISA Adds One Known Exploited Vulnerability to Catalog
• Related topic: CISA KEV Alert: CVE-2026-21962 — Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-
• Related topic: CVE-2026-78161 — CVSS 7.3 HIGH Severity | NVD Vulnerability Record
• Related topic: Ransomware attackers are zeroing in on mid-market companies
• Related topic: RedC2 Turns Compromised Linux Machines Into SOCKS5 Proxies for Internal Network Pivoting