CISA Red Team Fully Compromises Two Critical Infrastructure Orgs via ADCS ESC1 and AzureHound Cloud Enumeration (AA26-237A)
CISA Red Team Fully Compromises Two Critical Infrastructure (TL-2026-2161), also tracked as A Tale of Two SOCs, is a high-severity software vulnerability, first published 2026-08-26. It is attributed to CISA Red Team with high confidence, affects Microsoft Active Directory Certificate Services (AD CS), maps to 19 MITRE ATT&CK techniques (T1003, T1003.006, T1018), and is covered by 9 detection rules and 10 indicators of compromise.
Key facts for TL-2026-2161
- Threat ID
- TL-2026-2161
- Also known as
- A Tale of Two SOCs, AA26-237A
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-26
- Last reviewed
- 2026-08-26
- Attribution
- CISA Red Team
- Attribution confidence
- HIGH
- Motivation
- UNKNOWN
- Target sectors
- government facilities, water and wastewater systems, critical infrastructure
- Target regions
- united states of america
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in CISA Red Team Fully Compromises Two Critical Infrastructure
Malware and tooling: Rubeus, ADConnectDump, AzureHound, BloodHound - S0521, ROADrecon, Rubeus - S1071
CISA advisory AA26-237A, "A Tale of Two SOCs," documents two simultaneous authorized red team assessments — one against a Government Services and Facilities Sector organization, one against a Water and Wastewater Systems Sector organization — that used identical tradecraft (default credentials, phishing, ADCS ESC1 certificate abuse, DCSync/Golden Ticket, AzureHound/ROADrecon cloud enumeration, Microsoft Graph API abuse) to achieve full Active Directory and cloud compromise. One SOC never detected the intrusion amid thousands of higher-severity false positives; the other contained the initial phishing within 2-20 minutes and later caught the cloud-enumeration phase via Entra ID risky-user alerts on the AzureHound user agent and anomalous Graph API volume.
How CISA Red Team Fully Compromises Two Critical Infrastructure works
On 2026-08-25, CISA published AA26-237A, comparing two concurrent red team assessments run with the same tradecraft against critical infrastructure organizations to illustrate how detection maturity — not tooling — determines outcome.
Against Organization A (Government Services and Facilities Sector), the red team found a web application still using default credentials for built-in accounts, used that foothold to send phishing emails from a trusted internal address, and landed payloads on four workstations. From there it abused the domain's default Machine Account Quota (MAQ) to add unauthorized machine accounts, then exploited an ESC1-class misconfiguration in Active Directory Certificate Services — templates with `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` enabled and client-authentication EKUs — to request certificates impersonating privileged accounts. The team recovered cleartext database and service credentials from configuration files (including a `connections.json`-style file) and long-lived, non-expiring static AWS IAM access keys, then pivoted to the cloud by harvesting a Primary Refresh Token and abusing over-permissioned Entra ID applications, ultimately reading mail across the tenant. The SOC never detected any of it: staff were buried under thousands of false-positive alerts (many scored higher-severity than the actual intrusion), multiple siloed SOCs ran different EDR stacks with no shared visibility, and there were no written escalation procedures. The red team confirmed the miss by reading the defenders' own SOC email.
Against Organization B (Water and Wastewater Systems Sector), the same phishing payload was detected on execution and the affected workstations were isolated within 2-20 minutes, cutting off C2 before the intrusion could spread — so the engagement shifted to an assume-breach model from a designated non-privileged host. From there the team found a domain service account's password stored in cleartext inside an XML file on an SCCM distribution point; that account held rights sufficient to perform a DCSync attack and obtain the `krbtgt` hash. The team forged a Golden Ticket and used the resulting Kerberos tickets — via Seamless SSO — to authenticate to Azure without any user's cleartext password, running AzureHound, ROADrecon, and ADConnectDump for cloud enumeration and abusing Microsoft Graph API scopes (Mail.Read, Mail.ReadWrite, Chat.Read.All, Files.Read.All, Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All) — at one point re-enabling a disabled, MFA-exempt legacy AD-sync (MSOL_) account, DCSyncing its credentials, and adding a client secret to gain full mailbox access across the organization. The team also reached an OT-network bastion host reached via FTP credentials on a jump server, but outbound access was blocked and no C2 channel was established there. This time Organization B's custom Entra ID risky-user detections — "Unfamiliar sign-in properties" and "Suspicious API traffic" — flagged the AzureHound HTTP user agent and accounts exceeding Graph API request thresholds, and the SOC triaged, coordinated with engineering, and reimaged affected hosts.
Neither organization had Conditional Access enabled for workload identities, letting applications with broad Graph permissions bypass normal Conditional Access rules in both cases. CISA's core recommendation is architectural and procedural: disable `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` and restrict enrollment on ADCS templates, zero out Machine Account Quota where unneeded, eliminate cleartext credentials and rotate long-lived cloud keys, enforce Conditional Access for workload identities, treat SCCM as a Tier 0 asset, and — the advisory's central point — tune alerting to cut false-positive volume and give SOC staff clear escalation authority, since Organization B's success came from process maturity rather than superior tools.
MITRE ATT&CK techniques used in TL-2026-2161
Credential Access
T1003 OS Credential Dumping; T1003.006 OS Credential Dumping: DCSync; T1552.001 Unsecured Credentials: Credentials In Files; T1558.001 Steal or Forge Kerberos Tickets: Golden Ticket; T1649 Steal or Forge Authentication Certificates
Discovery
T1018 Remote System Discovery; T1069.002 Permission Groups Discovery: Domain Groups; T1087.002 Account Discovery: Domain Account; T1526 Cloud Service Discovery; T1615 Group Policy Discovery
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol
Initial Access
T1078 Valid Accounts; T1566 Phishing
Collection
T1114.002 Email Collection: Remote Email Collection
Persistence
T1136.002 Create Account: Domain Account
Execution
T1204.001 User Execution: Malicious Link
lateral-movement
T1550.001 Use Alternate Authentication Material: Application Access Token
Reconnaissance
T1589.001 Gather Victim Identity Information: Credentials; T1589.002 Gather Victim Identity Information: Email Addresses
Affected products and versions in CISA Red Team Fully Compromises Two Critical Infrastructure
- Microsoft — Active Directory Certificate Services (AD CS)
Vulnerable versions: templates with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT + client-auth EKU (ESC1) misconfigured
Fixed in: templates with enrollee-supplies-subject disabled and enrollment restricted to intended principals - Microsoft — Entra ID / Azure AD (incl. Azure AD Connect)
Vulnerable versions: tenants without Conditional Access for workload identities; over-permissioned applications; legacy MSOL_ sync accounts without MFA
Fixed in: N/A - configuration hardening, not a version fix - Microsoft — System Center Configuration Manager (SCCM)
Vulnerable versions: distribution points storing cleartext service-account credentials in configuration/XML files
Fixed in: N/A - configuration hardening, not a version fix
Remediation for CISA Red Team Fully Compromises Two Critical Infrastructure
Immediate actions
- Disable CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT on ADCS certificate templates and restrict who can enroll for client-authentication EKUs
- Set Machine Account Quota (MAQ) to zero for accounts that do not operationally need to join machines to the domain
- Remove cleartext service/database credentials from SCCM distribution-point files, configuration files, and network shares
- Rotate and revoke long-lived static AWS IAM access keys; require expiration
- Disable or remove unused legacy AD-sync (MSOL_) accounts, or enforce MFA on them
Workarounds
- Enable Conditional Access policies for workload identities (service principals/applications), not just user identities
- Audit Entra ID application permissions and remove excessive Microsoft Graph scopes (Mail.ReadWrite, Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All)
- Monitor for the AzureHound HTTP user-agent string and for accounts exceeding normal Microsoft Graph API request-volume thresholds
Longer-term hardening
- Consolidate SOC tooling and establish shared visibility across previously siloed SOCs/EDR stacks
- Implement alert-baseline tuning to reduce false-positive volume so real intrusions are not buried
- Write and rehearse incident escalation procedures; give SOC analysts authority to contain hosts without bureaucratic delay
- Treat SCCM (and similar endpoint-management platforms) as a Tier 0 asset with domain-controller-level protection
- Establish a token/credential revocation procedure for compromised PRTs and OAuth application secrets
Weaknesses (CWE) in CISA Red Team Fully Compromises Two Critical Infrastructure
CWE-798, CWE-522, CWE-269, CWE-613
Timeline of CISA Red Team Fully Compromises Two Critical Infrastructure
- Organization B's Entra ID risky-user detections flag the AzureHound user agent and anomalous Microsoft Graph API request volume; the SOC triages, coordinates with engineering, and reimages affected hosts before the OT-adjacent bastion host can be leveraged further.
- Red team forges a Golden Ticket and uses Kerberos-based Seamless SSO to authenticate to Azure, running AzureHound, ROADrecon, and ADConnectDump for cloud enumeration and abusing Microsoft Graph API scopes to access mailboxes tenant-wide.
- From an assume-breach foothold, the red team finds a domain service account's password stored in cleartext inside an XML file on an SCCM distribution point and performs a DCSync attack to obtain the krbtgt hash.
- The same phishing payload against Organization B (Water and Wastewater Systems) is detected on execution; the SOC isolates affected workstations within 2-20 minutes, forcing the red team into an assume-breach model.
- Red team recovers cleartext credentials and non-expiring static AWS IAM keys, harvests a Primary Refresh Token, and abuses over-permissioned Entra ID applications to read tenant mail; Organization A's SOC never detects the intrusion amid thousands of higher-severity false positives.
- Red team abuses Organization A's default Machine Account Quota to add unauthorized machine accounts and exploits an ESC1-vulnerable ADCS certificate template to request certificates impersonating privileged accounts.
- Red team gains initial access to Organization A (Government Services and Facilities) via a web application using default credentials, then sends phishing emails from a trusted internal address, landing payloads on four workstations.
- CISA publishes AA26-237A, "A Tale of Two SOCs," comparing two concurrent red team assessments against critical infrastructure organizations.
- SecurityAffairs, The Hacker News, and other outlets report on AA26-237A's findings as a case study in SOC detection maturity across critical infrastructure sectors.
Sources cited for CISA Red Team Fully Compromises Two Critical Infrastructure
- A Tale of Two SOCs: Insights From Two Red Team Assessments (AA26-237A)
- CISA Advisory Highlights Red Team Findings to Help Organizations Assess Risk, Identify Threats and Enable Effective Incident Response
- CISA Red Team Fully Compromised Two Critical Infrastructure Orgs
- CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
- Cybersecurity Advisory: A Tale of Two SOCs (Vulnerability Vault)
- A Tale of Two SOCs: Insights From Two Red Team Assessments
- A Tale of Two SOCs: Insights From Two Red Team Assessments (mirror)
More in vulnerability
- Zyxel GS1900 Series Switches Stack-Based Buffer Overflow (CVE-2026-7273) Actively Exploited by Kapibala/Red Heron in Global 996-Device Campaign — Added to CISA KEV
- Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection Chain to Forced Theme Install
- F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random Subdomain Attack (CVE-2026-11622)
- Click2Shell WordPress Exploit Chain Lets Attackers Gain RCE With a Single Malicious Link
- SolarWinds Access Rights Manager Hard-Coded Cryptographic Key (CVE-2026-28326) Enables Unauthenticated RCE
Detection coverage for TL-2026-2161
As of 2026-08-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2161 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.