Two SOCs, Two Outcomes: Lessons From Red Team Assessments

Summary

CISA conducted simultaneous red team assessments at two organizations, showing how differences in defensive maturity can dramatically affect breach outcomes. One organization failed to detect complete domain compromise and lateral movement, while the other successfully identified and contained the initial footholds. The report exposes critical weaknesses in cloud identity management, Active Directory configurations, and organizational incident response processes.

Investigation

The investigation included two concurrent simulations, one at a Government Services and Facilities Sector organization and another at a Water and Wastewater Systems Sector organization. Red teams used techniques including phishing, BloodHound, and ADCS exploitation to gain access and expand control. Investigators examined how security posture, excessive alert volumes, and organizational silos influenced whether defenders successfully detected and contained the simulated intrusions.

Mitigation

Recommended mitigations include tuning detection tools to reduce alert noise and establishing clear escalation procedures for security teams. Organizations should implement Conditional Access for workload identities, enforce phishing-resistant MFA, and regularly rotate cloud credentials. Strengthening Active Directory security by correcting misconfigured ADCS templates and addressing risky Machine Account Quotas (MAQ) is also critical.

Response

When unauthorized activity is detected, organizations should immediately isolate affected workstations and cloud accounts to disrupt C2 communications. Defenders should follow established incident response playbooks that include revoking access and refresh tokens and auditing service principal permissions. Effective response also depends on eliminating organizational silos so SOC teams can take rapid and decisive containment actions.

## Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands: An adversary has gained an initial foothold on a Windows workstation. To facilitate lateral movement and privilege escalation, they need to map the Active Directory environment. They download the SharpHound executable. To avoid immediate detection by basic AV, they attempt to run it using its standard command-line flags to gather all domain information. The goal is to generate the specific string SharpHound in the process creation event to test if the SOC’s detection logic is functional.

• Regression Test Script:

  # Simulation of SharpHound execution to trigger the detection rule.
  # Note: In a real scenario, the file would be downloaded. 
  # For this simulation, we create a dummy file to mimic the process execution.
  
  $dummyPath = "$env:TEMPSharpHound.exe"
  New-Item -Path $dummyPath -ItemType File -Force
  
  # Execute the dummy file with the keyword used in the detection logic
  # We use Start-Process to ensure it shows up clearly in process creation logs
  Start-Process -FilePath $dummyPath -ArgumentList "--CollectionMethod All --Domain corp.local" -NoNewWindow

• Cleanup Commands:

  # Remove the dummy file used for simulation
  Remove-Item -Path "$env:TEMPSharpHound.exe" -Force