CISA Red Team Compromises Active Directory and Critical Business Systems

CISA’s “A Tale of Two SOCs” advisory details red team engagements where phishing and abuse of Active Directory misconfigurations (Machine Account Quota, vulnerable AD CS templates, SCCM artifacts) enabled credential theft, DCSync activity, Golden Ticket risk, and domain compromise; one organization’s SOC failed to detect and contain the operation while another’s rapid triage and coordinated monitoring limited impact. The report emphasizes operational deficiencies (escalation, communication) as well as technical mitigations such as restricting machine account quotas, remediating vulnerable certificate templates, expiring service/cloud credentials, and applying Conditional Access.