On August 25, 2026, CISA published advisory AA26-237a, A Tale of Two SOCs, documenting simultaneous red team assessments against two organizations — and the results should make every CISO and SOC lead uncomfortable. In both environments, CISA's operators achieved full domain compromise and gained access to sensitive business systems (SBSs) and cloud resources. The difference wasn't the attack. It was the defense.
Organization A never detected the intrusion. No alerts triaged, no containment, no incident declared — the red team walked from initial access to domain dominance and cloud access unopposed. Organization B detected the initial compromise attempts early, isolated affected systems, and raised the cost of intrusion so aggressively that the red team was forced to pivot into an assume breach model just to continue the engagement.
This advisory is not about a single vulnerability. It's about the TTP stack that real-world adversaries and red teams use every day: initial access, privilege escalation, credential theft, lateral movement, persistence, and cloud pivoting. The lesson CISA is delivering to critical infrastructure operators is blunt: your prevention controls will eventually fail, and your SOC's ability to detect and contain within the first hours of compromise is the only thing standing between a phishing email and a full domain plus cloud takeover. This post breaks down the attack chain, gives you production-ready detections, and lays out the hardening steps that separate Organization A from Organization B.
Technical Analysis
What CISA's Red Team Demonstrated
The advisory describes a composite attack chain representative of what CISA's red team executed across both assessments. Based on the published findings, the operation followed the classic intrusion lifecycle:
- Initial Access — The red team established a foothold through externally facing weaknesses and social engineering vectors. Critically, Organization B detected activity at this stage; Organization A did not. This is the single highest-leverage detection point in the entire kill chain.
- Execution and Defense Evasion — Post-exploitation tooling was staged and executed, including living-off-the-land binaries (LOLBins) and script interpreters. In Organization A, endpoint telemetry either wasn't collected, wasn't centralized, or wasn't being watched.
- Credential Access — The team harvested credentials from compromised endpoints, including LSASS memory access and cached domain credentials, enabling rapid privilege escalation.
- Privilege Escalation and Lateral Movement — Using harvested credentials, the red team moved laterally via administrative protocols (SMB, RDP, WinRM) and remote service execution, escalating to Domain Admin-equivalent access. Full domain compromise was achieved in both environments — meaning Organization A's DCs, and by extension every identity in the forest, were owned without a single effective alert.
- Persistence and Cloud Pivot — With domain dominance established, the team accessed sensitive business systems and pivoted into cloud resources, exploiting the trust relationship between on-premises identity and cloud tenants (synchronized accounts, hybrid join, federation trust).
Why Organization B Won
Organization B's success was not a product purchase — it was operational maturity:
- Endpoint telemetry was actually being reviewed. Initial compromise behaviors — suspicious child processes, anomalous script execution, unusual authentication patterns — generated alerts that humans triaged.
- Containment was fast and decisive. Affected systems were isolated before the red team could complete credential harvesting and lateral movement at scale.
- Assume breach posture. When containment happened, Organization B didn't assume the incident was over. They forced the engagement into an assume breach model, hunting for residual access rather than declaring victory after the first isolation.
The Identity-to-Cloud Pivot Is the Real Prize
The most dangerous phase described in AA26-237a is the pivot from on-prem domain compromise to cloud resource access. In hybrid environments, this typically exploits:
- Password hash sync / cloud-synced privileged accounts — an on-prem Domain Admin whose account is synchronized to Entra ID becomes a cloud Global Admin-equivalent.
- Token and credential theft from hybrid-joined devices — Primary Refresh Tokens (PRTs) and cached OAuth tokens enable cloud access without passwords or MFA prompts.
- Federation and trust abuse — control of AD CS, federation signing certificates, or sync service accounts provides durable cloud access.
If your SOC treats on-prem AD and cloud identity as separate detection domains, you are Organization A waiting to happen.
Exploitation Status
This advisory contains no CVE — it documents technique-level tradecraft that maps directly to MITRE ATT&CK and is in active, daily use by ransomware affiliates, initial access brokers, and nation-state operators throughout 2025 and 2026. Every behavior below is observable with standard Windows and cloud telemetry. There is no excuse for silence on these detections.
Detection & Response
The detections below target the behaviors at the core of CISA's findings: credential theft, lateral movement via remote service execution, persistence, and the on-prem-to-cloud identity pivot. These are tuned to fire on tradecraft, not on Tuesday morning sysadmin work.
Sigma Rules
---
title: LSASS Memory Access by Non-System Process
tid: 1c9f2e47-3a5b-4d68-9f21-7c8e0b4a2d31
status: experimental
description: Detects processes accessing LSASS memory with access masks consistent with credential dumping, a key step in the red team's path to domain compromise per CISA AA26-237a.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a
- https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/08/26
tags:
- attack.credential_access
- attack.t1003.001
logsource:
category: process_access
product: windows
detection:
selection_target:
TargetImage|endswith: '\lsass.exe'
selection_access:
GrantedAccess|contains:
- '0x1010'
- '0x1410'
- '0x1438'
- '0x143a'
- '0x1fffff'
filter_legit:
SourceImage|startswith:
- 'C:\\Windows\\System32\\'
- 'C:\\Program Files\\Microsoft Defender'
- 'C:\\ProgramData\\Microsoft\\Windows Defender'
condition: selection_target and selection_access and not filter_legit
falsepositives:
- Legitimate EDR/AV products and backup agents accessing LSASS
- Authentication verification tools in managed environments
level: high
---
title: Remote Service Creation for Lateral Movement
tid: 2d8a3f59-4b6c-5e79-0a32-8d9f1c5b3e42
status: experimental
description: Detects creation of services with randomly named or LOLBin-style binaries over administrative shares, matching red team lateral movement tradecraft (PsExec-style execution) described in CISA AA26-237a.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a
- https://attack.mitre.org/techniques/T1021/002/
- https://attack.mitre.org/techniques/T1569/002/
author: Security Arsenal
date: 2026/08/26
tags:
- attack.lateral_movement
- attack.t1021.002
- attack.t1569.002
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\services.exe'
selection_paths:
Image|startswith:
- 'C:\\Users\\'
- 'C:\\ProgramData\\'
- 'C:\\Windows\\Temp\\'
- 'C:\\Temp\\'
- '\\'
filter_known:
Image|contains:
- '\\Microsoft\\'
- '\\Google\\'
- '\\Mozilla\\'
condition: selection_parent and selection_paths and not filter_known
falsepositives:
- Software deployment tools (SCCM, PDQ, Intune) staging binaries in temp paths
- Browser and application updaters
level: high
---
title: Directory Replication from Non-DC Host (DCSync)
tid: 3e9b4a60-5c7d-6f80-1b43-9e0a2d6c4f53
status: experimental
description: Detects Active Directory replication requests originating from hosts that are not domain controllers, indicative of DCSync-style credential theft used to complete domain compromise per CISA AA26-237a.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a
- https://attack.mitre.org/techniques/T1003/006/
author: Security Arsenal
date: 2026/08/26
tags:
- attack.credential_access
- attack.t1003.006
logsource:
category: network_connection
product: windows
detection:
selection_port:
DestinationPort:
- 135
- 445
selection_protocol:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\mshta.exe'
- '\wmic.exe'
condition: selection_port and selection_protocol
falsepositives:
- Administrative scripts querying AD via script interpreters
- Vulnerability scanners performing authenticated AD checks
level: medium
KQL — Microsoft Sentinel / Defender
This hunt stitches the full intrusion lifecycle into a single query: suspicious LSASS access, remote service execution, and anomalous lateral movement, correlated per device over a 24-hour window. Run it as a hunting query first, baseline it, then promote the correlated hits to an analytics rule.
// CISA AA26-237a Hunt: Credential theft + lateral movement correlation
// Maps to red team TTPs: LSASS access, remote service creation, admin-share execution
let lookback = 24h;
let lsassAccess =
DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "OpenProcessApiCall"
| where FileName =~ "lsass.exe" or AdditionalFields has "lsass"
| project LSASSTime = Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName;
let remoteServiceExec =
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName =~ "services.exe"
| where FolderPath has_any ("\\Users\\", "\\ProgramData\\", "\\Temp\\")
| where not(FolderPath has_any ("\\Microsoft\\", "\\Google\\"))
| project ServiceExecTime = Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName;
let adminShareWrites =
DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where RemotePort == 445
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "wmic.exe", "psexec.exe", "cmd.exe")
| project SMBTime = Timestamp, DeviceName, RemoteIP, InitiatingProcessFileName;
lsassAccess
| join kind=inner remoteServiceExec on DeviceName
| join kind=leftouter adminShareWrites on DeviceName
| where ServiceExecTime between (LSASSTime .. LSASSTime + 2h)
| summarize FirstSeen = min(LSASSTime), LastSeen = max(ServiceExecTime),
LSASSProcesses = make_set(InitiatingProcessFileName),
ServiceBinaries = make_set(FolderPath),
SMBTargets = make_set(RemoteIP)
by DeviceName, AccountName
| sort by FirstSeen asc
For hybrid/cloud coverage, pair this with an IdentityLogonEvents or SigninLogs hunt for on-prem-compromised accounts appearing in cloud sign-ins from new IPs or without MFA — that is the on-prem-to-cloud pivot CISA's red team exploited.
// Cloud pivot hunt: accounts active on-prem AND signing into cloud from anomalous sources
let lookback = 24h;
let onpremCompromised =
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where ProcessCommandLine has_any ("sekurlsa", "lsadump", "dcsync", "procdump", "comsvcs.dll")
| summarize by AccountName, DeviceName;
SigninLogs
| where TimeGenerated > ago(lookback)
| where UserPrincipalName in (onpremCompromised | project tostring(AccountName))
or UserPrincipalName has_any (onpremCompromised | project AccountName)
| summarize SignInCount = count(), IPs = make_set(IPAddress), Apps = make_set(AppDisplayName),
MFAResults = make_set(tostring(AuthenticationDetails))
by UserPrincipalName, ResultType
| project UserPrincipalName, ResultType, SignInCount, IPs, Apps
Velociraptor VQL
Use this artifact during an assume-breach hunt (exactly the model Organization B forced) to sweep endpoints for credential-dumping artifacts and lateral-movement staging.
-- AA26-237a Assume-Breach Sweep: credential dumping tooling and staged service binaries
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(sekurlsa|lsadump::|dcsync|comsvcs\.dll.*MiniDump|procdump.*lsass|ntdsutil.*ifm)'
OR Exe =~ '(?i)(\\\\users\\\\[^\\\\]+\\\\[^\\\\]+\.exe$|\\\\programdata\\\\[^\\\\]+\.exe$|\\\\windows\\\\temp\\\\[^\\\\]+\.exe$)'
-- Hunt for suspicious services registered from non-standard paths (persistence + lateral movement)
SELECT Name, DisplayName, PathName, StartName, State
FROM wmi(query="SELECT Name, DisplayName, PathName, StartName, State FROM Win32_Service")
WHERE PathName =~ '(?i)(\\\\users\\\\|\\\\programdata\\\\|\\\\temp\\\\|cmd\.exe|powershell)'
AND NOT PathName =~ '(?i)(microsoft|windows\\\\system32|google|mozilla)'
Hardening and Verification Script
This PowerShell script validates the controls that determine whether you're Organization A or Organization B: LSASS protection, credential guard, privileged account hygiene, and detection coverage. Run as Administrator on a management host; it reports, and where safe, remediates.
# AA26-237a Defensive Posture Verification — run elevated
# Checks LSASS protection, Credential Guard, SMB signing, and privileged group hygiene
$report = @()
# 1. LSASS RunAsPPL (protects against trivial credential dumping)
$lsaKey = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
$runAsPPL = (Get-ItemProperty -Path $lsaKey -Name RunAsPPL -ErrorAction SilentlyContinue).RunAsPPL
if ($runAsPPL -ne 1) {
$report += "[FAIL] LSASS RunAsPPL not enabled. Setting RunAsPPL=1 (reboot required)."
Set-ItemProperty -Path $lsaKey -Name RunAsPPL -Value 1 -Type DWord
} else { $report += "[PASS] LSASS RunAsPPL enabled." }
# 2. WDigest cleartext credential caching must be disabled
$wdigest = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest"
$useLogonCred = (Get-ItemProperty -Path $wdigest -Name UseLogonCredential -ErrorAction SilentlyContinue).UseLogonCredential
if ($useLogonCred -ne 0) {
$report += "[FAIL] WDigest cleartext caching possible. Setting UseLogonCredential=0."
New-Item -Path $wdigest -Force | Out-Null
Set-ItemProperty -Path $wdigest -Name UseLogonCredential -Value 0 -Type DWord
} else { $report += "[PASS] WDigest cleartext caching disabled." }
# 3. Credential Guard status
$cg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue
if ($cg.SecurityServicesRunning -notcontains 1) {
$report += "[WARN] Credential Guard not running. Enable via GPO/Intune (UEFI lock recommended)."
} else { $report += "[PASS] Credential Guard running." }
# 4. SMB signing required (mitigates relay-based lateral movement)
$smbServer = Get-SmbServerConfiguration
if (-not $smbServer.RequireSecuritySignature) {
$report += "[WARN] SMB signing not required on server. Require it on DCs and SBS hosts via GPO."
} else { $report += "[PASS] SMB signing required." }
# 5. Privileged group membership drift — Domain Admins should be small and known
$da = Get-ADGroupMember -Identity "Domain Admins" -Recursive -ErrorAction SilentlyContinue
$report += "[INFO] Domain Admins count: $($da.Count). Members: $(($da.SamAccountName) -join ', ')"
if ($da.Count -gt 5) { $report += "[WARN] Domain Admins exceeds recommended size. Audit and reduce." }
# 6. Check for cloud-synced privileged accounts (the on-prem-to-cloud pivot path)
$synced = Get-ADUser -Filter {adminCount -eq 1} -Properties adminCount -ErrorAction SilentlyContinue |
Where-Object { $_.DistinguishedName -notmatch "Privileged Access Workstations" }
$report += "[INFO] adminCount=1 accounts: $($synced.Count). Verify NONE of these are synced to Entra ID."
$report | ForEach-Object { Write-Host $_ }
$report | Out-File "$env:TEMP\AA26237a_PostureReport.txt"
Write-Host "`nReport saved to $env:TEMP\AA26237a_PostureReport.txt"
Remediation
CISA's advisory is technique-focused, so remediation is architectural and operational rather than a patch Tuesday exercise. Prioritize in this order:
- Close the detection gap at initial access. Organization B won here. Ensure EDR coverage on 100% of endpoints and servers, with tamper protection enabled and telemetry flowing to a monitored SIEM. Alert on script interpreters spawned by Office applications, browsers, and email clients.
- Protect credentials like the domain depends on it — because it does. Enable LSASS RunAsPPL and Credential Guard fleet-wide. Deploy LAPS (Windows LAPS) for local admin rotation. Disable WDigest. These three controls alone would have broken the red team's fastest escalation path.
- Segment and tier administration. Implement the Microsoft tiered admin model: Domain Admins never log on to workstations or member servers, and Tier 0 assets (DCs, AD CS, identity sync servers) are reachable only from privileged access workstations. Enable SMB signing and LDAP signing/channel binding on DCs to kill relay attacks.
- Sever the on-prem-to-cloud blast radius. Do not synchronize privileged on-prem accounts to Entra ID. Require phishing-resistant MFA (FIDO2/passkeys) for all cloud admin roles, enforce Conditional Access with compliant-device requirements, and alert on any cloud sign-in from accounts recently active in on-prem anomalies.
- Adopt assume breach as your operating model. After any containment, hunt for residual access: new service accounts, abnormal group membership, unexpected federation changes, and OAuth consent grants. Organization B's posture — isolate, then hunt — is the standard.
- Test it. Commission an adversary emulation or purple team engagement against your own detection stack using the TTPs above. CISA's red team found what your red team will find. Better yours than theirs.
Review the full advisory and CISA's cross-sector mitigations at https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a, and map your detections against MITRE ATT&CK techniques T1003 (OS Credential Dumping), T1021 (Remote Services), T1552 (Unsecured Credentials), and T1078 (Valid Accounts).
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.