CISA Red Team Breached Two Critical Infrastructure Orgs — Detection Engineering Lessons from a Double Domain Compromise

CISA has published the results of two red team assessments it ran simultaneously against two critical infrastructure organizations, using similar tradecraft against both targets. The headline outcome should make every CISO in the sector uncomfortable: both organizations were fully compromised at the domain level, yet the defensive outcomes diverged sharply — one organization's defenders detected nothing. No alerts, no escalation, no containment. The intrusion ran its course unobserved until the red team report landed.

I have led and debriefed enough red team engagements to tell you that this outcome is not exotic — it is the median state of enterprise detection. What makes this CISA publication valuable is that it is a controlled A/B test of defensive maturity: same threat actor capability, same class of tradecraft, two organizations, two radically different visibility postures. If you operate in critical infrastructure — or any environment where Active Directory is the identity backbone — this report is effectively a free purple team exercise. Your job now is to verify that your SOC would have been the organization that saw something.

There is no CVE here. There is no patch. The vulnerability is architectural: insufficient telemetry, unmonitored identity infrastructure, and detection content that was never validated against real adversary behavior.

Technical Analysis: How Domain-Level Compromise Actually Happens

CISA's red teams operate like the nation-state actors they emulate. While each engagement has unique details, a domain-level compromise against a critical infrastructure organization almost invariably follows a well-understood chain. Understanding each phase is essential, because every phase is a detection opportunity the losing organization missed.

Phase 1 — Initial Access and Foothold

Typical vectors in these assessments include spearphishing with credential harvesting or malicious payloads, or exploitation of exposed remote services. The foothold itself is often the least important part of the operation — a single beacon on a single workstation is sufficient.

Phase 2 — Discovery and Credential Theft

Once inside, the operator enumerates the environment: domain controllers, privileged groups, trust relationships, and where high-value credentials are exposed. Common tooling behaviors include:

• net group "Domain Admins" /domain, nltest /dclist, nltest /domain_trusts — built-in discovery that blends with admin noise unless you baseline it
• LDAP enumeration tooling (SharpHound/BloodHound-style collection) generating high-volume directory queries from a single host
• Credential extraction from memory on hosts where privileged users have logged on — the single most common privilege escalation path in assessments I have debriefed

Phase 3 — Privilege Escalation to Domain Dominance

The critical moment. Typical techniques:

• Kerberoasting: requesting service tickets for SPN-bearing accounts (often forced to RC4) and cracking them offline — leaves only a service ticket request on the wire
• DCSync / replication abuse: using tools that invoke the directory replication protocol (lsadump::dcsync, Invoke-DCSync) to pull password hashes directly from a DC, including the krbtgt account
• Abuse of over-privileged service accounts and misconfigured delegation — the quiet workhorse of real intrusions

Phase 4 — Lateral Movement and Objective

With domain credentials in hand, movement is trivially easy against flat networks: PsExec-style service execution, WMI, WinRM, and SMB to ADMIN$. In critical infrastructure environments, this is where the blast radius extends toward operational technology enclaves — which is precisely why CISA prioritizes these assessments.

The Real Finding: Detection Asymmetry

The organization that detected nothing did not lack a firewall. It lacked:

1. Telemetry — no process/command-line logging with retention, no DC replication auditing, no ticket-granting-service request visibility
2. Identity-centric detection — no alerting on replication from non-DCs, RC4 downgrade requests, or privileged group changes
3. Validated detection content — rules that existed on paper but were never tested against the techniques they were meant to catch

Detection & Response

The detections below target the highest-fidelity, lowest-noise behaviors in this attack chain. Every one of them would have generated signal in the organization that saw nothing.

Sigma Rules

---
title: Directory Replication Abuse via DCSync Tooling
id: 4f2b8c31-9d6e-4a17-b3c5-7e1f0a9d2b44
status: experimental
description: Detects command-line artifacts of DCSync-style directory replication abuse used to extract credential material including krbtgt, as employed by red teams and nation-state actors to achieve domain dominance.
references:
  - https://attack.mitre.org/techniques/T1003/006/
  - https://thehackernews.com/2026/08/cisa-red-team-compromised-two-critical.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.credential_access
  - attack.t1003.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'lsadump::dcsync'
      - 'Invoke-DCSync'
      - 'dcsync '
      - '/user:krbtgt'
falsepositives:
  - Authorized red team or penetration testing activity
level: critical
---
title: Active Directory Reconnaissance via Built-In Command-Line Tools
id: 8c1e5a72-3b94-4d08-a2f6-6c9d1e4b7a53
status: experimental
description: Detects rapid-fire use of built-in Windows utilities for domain discovery, a hallmark early behavior in red team and adversary intrusions preceding credential theft and lateral movement.
references:
  - https://attack.mitre.org/techniques/T1069/002/
  - https://attack.mitre.org/techniques/T1482/
  - https://thehackernews.com/2026/08/cisa-red-team-compromised-two-critical.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.discovery
  - attack.t1069.002
  - attack.t1482
logsource:
  category: process_creation
  product: windows
detection:
  selection_net:
    Image|endswith: '\net.exe'
    CommandLine|contains:
      - 'group "Domain Admins" /domain'
      - 'group "Enterprise Admins" /domain'
      - 'localgroup administrators'
  selection_nltest:
    Image|endswith: '\nltest.exe'
    CommandLine|contains:
      - '/dclist'
      - '/domain_trusts'
      - '/dsgetdc'
  condition: 1 of selection_*
falsepositives:
  - IT helpdesk and systems administration scripts; baseline by host and user and alert on deviation
level: medium
---
title: PsExec-Style Remote Service Execution
id: 2d7f4b19-6a83-4e52-c1d8-9b3a5f0e6c71
status: experimental
description: Detects execution of PsExec and clone service binaries on target hosts, a common lateral movement mechanism used to achieve domain-wide control during red team assessments and intrusions.
references:
  - https://attack.mitre.org/techniques/T1569/002/
  - https://attack.mitre.org/techniques/T1021/002/
  - https://thehackernews.com/2026/08/cisa-red-team-compromised-two-critical.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1021.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\PAExec.exe'
      - '\RemComSvc.exe'
      - '\csexecsvc.exe'
falsepositives:
  - Legitimate administrative use of PsExec; restrict authorized usage to a defined admin host list and alert on all other sources
level: high

KQL Hunt (Microsoft Sentinel / Defender)

This query chains early discovery behavior with downstream lateral movement artifacts on the same device, prioritizing hosts where both occur within a short window — the pattern that separates an intrusion from an admin's afternoon.

let Lookback = 7d;
let DiscoveryCmds = dynamic(["group \"Domain Admins\" /domain", "/dclist", "/domain_trusts", "Invoke-DCSync", "lsadump::dcsync"]);
let Discovery =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any (DiscoveryCmds)
    | summarize DiscoveryCmdCount = count(), FirstDiscovery = min(TimeGenerated),
                DiscoveryCmdLines = make_set(ProcessCommandLine, 10)
        by DeviceId, DeviceName, InitiatingProcessAccountName;
let Lateral =
    DeviceEvents
    | where TimeGenerated > ago(Lookback)
    | where ActionType == "ServiceInstalled"
    | extend ServiceInfo = parse_json(AdditionalFields)
    | extend ServiceName = tostring(ServiceInfo.ServiceName), ServicePath = tostring(ServiceInfo.FileName)
    | where ServiceName has_any ("PSEXESVC", "PAExec", "RemCom")
       or ServicePath has_any ("ADMIN$", "\\Windows\\Temp\\", "\\Users\\Public\\")
    | summarize ServicesInstalled = make_set(ServiceName, 10), FirstService = min(TimeGenerated)
        by DeviceId;
Discovery
| join kind=inner Lateral on DeviceId
| project DeviceName, InitiatingProcessAccountName, DiscoveryCmdCount, FirstDiscovery,
          ServicesInstalled, FirstService, DiscoveryCmdLines
| order by FirstDiscovery asc;

Run it daily. Any non-zero result that is not your own authorized pen test deserves an incident ticket.

Velociraptor VQL

This artifact hunts for persistence and staging artifacts consistent with post-compromise activity: services and processes executing from user-writable staging directories, enriched with live network connections.

-- Hunt for processes and persistence executing from attacker staging directories
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime,
       netstat() AS Connections
FROM pslist()
WHERE Exe =~ '(?i)\\(Temp|Tmp|Public|AppData\\Local\\Temp|ProgramData)\\'
   OR CommandLine =~ '(?i)(psexesvc|paexec|remcom|lsadump::dcsync|invoke-dcsync)'

Follow it with a second pass over HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services via glob() for services whose ImagePath resolves outside System32 and Program Files — that is where red team persistence survives reboots.

Verification and Hardening Script

Run this on a management host with Domain Admin-equivalent read rights to validate the controls that would have caught this activity. It checks replication-access auditing coverage, flags accounts with SPNs still permitting RC4, reports krbtgt password age, and surfaces recent privileged group changes.

# CISA Red Team Findings - AD Detection & Hardening Verification
Import-Module ActiveDirectory

# 1. Check krbtgt password age (>180 days means golden tickets persist after any past compromise)
$krbtgt = Get-ADUser krbtgt -Properties PasswordLastSet
$krbtgtAge = (New-TimeSpan -Start $krbtgt.PasswordLastSet -End (Get-Date)).Days
Write-Host "[+] krbtgt password age: $krbtgtAge days (reset twice if >180)"

# 2. Find SPN accounts (kerberoastable) excluding machine accounts
Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties ServicePrincipalName, PasswordLastSet, Enabled |
  Where-Object {$_.Enabled} |
  Select-Object SamAccountName, PasswordLastSet, @{n='SPNs';e={$_.ServicePrincipalName -join '; '}} |
  Format-Table -AutoSize

# 3. Recent Domain/Enterprise Admins membership changes (last 30 days) via security log
$dc = (Get-ADDomainController -Discover).HostName
Get-WinEvent -ComputerName $dc -FilterHashtable @{LogName='Security'; Id=4728,4732,4756; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Id, Message | Format-List

# 4. Verify replication-access auditing (4662) is enabled on the domain root
$audit = Get-AuditPolicy -Category "DS Access" -ErrorAction SilentlyContinue
$audit | Format-Table Subcategory, Setting -AutoSize

# 5. Confirm replication events sourced only from legitimate DCs (review output for anomalies)
$dcList = (Get-ADDomain).ReplicaDirectoryServers
Get-WinEvent -ComputerName $dc -FilterHashtable @{LogName='Security'; Id=4662; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Where-Object {$_.Message -match '1131f6aa|1131f6ad|89e95b76'} |
  ForEach-Object {
    $src = ([regex]::Match($_.Message, 'Account Name:\s+(\S+)')).Groups[1].Value
    if ($dcList -notcontains ($src -replace '\$','')) { Write-Warning "Replication access by non-DC: $src" }
  }

Remediation: Closing the Gap CISA Just Documented

This is a detection-engineering and architecture problem, not a patch cycle. Prioritize in this order:

1. Instrument the identity tier first. Enable Advanced Audit Policy on all domain controllers: DS Access → Audit Directory Service Access, Account Logon → Audit Kerberos Service Ticket Operations. Alert on directory replication access (4662 with replication GUIDs) from any host that is not a domain controller. This single rule catches DCSync.
2. Eliminate silent kerberoasting. Migrate SPN-bearing service accounts to gMSA or 25+ character random passwords, enforce AES-only ticket encryption where supported, and alert on RC4 ticket requests from any host.
3. Constrain lateral movement. Block workstation-to-workstation SMB/RPC/WinRM via host firewall policy, restrict PsExec-class remote service creation to a documented jump-host list, and alert on all deviations.
4. Deploy canaries. A fake "Domain Admin" account with no logon rights and a honey SPN account generate zero-noise, high-severity tripwires. If one fires, you have an incident — full stop.
5. Reset krbtgt twice if you have any reason to suspect prior undetected compromise — and given the findings in this report, assume-breach posturing argues for doing it on schedule anyway.
6. Validate your detection content against adversary emulation. Run an Atomic Red Team or MITRE CALDERA exercise mapping to T1003.006, T1558.003, T1569.002, and T1021 within 30 days. A Sigma rule that has never fired in a test is a hypothesis, not a control.
7. Segment IT from OT. In critical infrastructure environments, verify there is no path from a compromised corporate domain to operational technology enclaves — harden trust boundaries, broker all access through hardened jump infrastructure, and monitor inter-zone traffic.

Review the full engagement details and CISA's red team guidance at the source report and CISA's published red team assessment advisories. Then ask the only question that matters: if CISA's red team started in your environment tomorrow morning, which of the two organizations in this story would you be?

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub