A Tale of Two SOCs: Insights From Two Red Team Assessments

This CISA advisory summarizes two red team assessments in which attackers leveraged phishing, Active Directory misconfigurations (MAQ, ADCS), credential theft/DCSync, Kerberos ticket abuse, and excessive cloud application permissions to achieve domain compromise and cloud/SBS access; Organization B detected and limited impacts through tuned detection and rapid response while Organization A failed to detect or contain the activity. The advisory maps the red team’s techniques to MITRE ATT&CK, documents defensive gaps, and provides prioritized mitigations for AD, cloud, endpoint management, and IT/OT segmentation.