As reported by SecurityAffairs, CISA's advisory AA26-237A documents a side-by-side red team assessment at two critical infrastructure organizations that ought to be required reading for every SOC lead and CISO in the country. The takeaway isn't novel: the same attack playbook fully compromised both environments, but only one organization noticed. The other learned about it when CISA knocked on the door.
What makes this assessment uniquely valuable is the controlled comparison. CISA used comparable techniques against both targets—initial access, Active Directory Certificate Services abuse (ESC1), lateral movement, cloud pivot. Organization A (Government Services and Facilities) fell completely. Organization B (Water and Wastewater) detected initial compromise attempts within minutes, isolated affected hosts, and forced the red team into an assume-breach posture. Same attack, opposite outcomes. The variable was defensive maturity, not attacker sophistication.
The ESC1 Problem Nobody Talks About
Organization A's path to domain admin is depressingly familiar to anyone who has performed internal penetration testing in the last three years. A misconfigured AD CS certificate template with the ESC1 vulnerability (certified as CVE-2021-26887 adjacent — specifically documented under Certify and the original Black Hat 2021 research by SpecterOps) allowed a low-privileged user to request certificates impersonating any domain account, including administrators. This is not a zero-day. This is a misconfiguration that persists in a staggering number of environments because AD CS templates are rarely audited.
Combined with default credentials on an internet-facing web application, the red team had domain control within hours. The phishing emails sent from a trusted internal address to gain initial workstation access is a particularly elegant touch—social engineering leveraging the organization's own trust infrastructure against itself.
Alert Fatigue Is a Security Failure, Not a Nuisance
The most damning detail in this report: Organization A's SOC was receiving thousands of false positive alerts, many rated higher severity than the actual intrusion alerts generated by real red team activity. Staff reviewed SCCM-related alerts from genuine attacker movement, couldn't identify the system's owner, and marked it as a false positive. The red team then read SOC email to confirm the miss.
This is the real story. Organization A had multiple separate SOCs running different EDR solutions with no correlation between them. They had tooling. They had staff. What they lacked was tuning, baselining, and unified visibility. The alert was there. The alert fired. A human looked at it and dismissed it because the signal-to-noise ratio was so catastrophically broken that genuine intrusion indicators were indistinguishable from routine operational chatter.
If your SOC is generating thousands of alerts per day and your response is 'we'll get to the important ones,' you have a detection engineering problem, not a staffing problem. Throwing more analysts at an untuned SIEM doesn't fix alert fatigue—it just distributes the fatigue across more people.
What Separated Organization B
CISA's report doesn't detail Organization B's specific controls, but the outcome speaks volumes: rapid identification of initial compromise, host isolation, and forcing the adversary into an assume-breach model. This is what mature detection and response looks like. It requires:
Shield53 Recommendations
Immediate Actions
- Audit AD CS templates today. Run Certify or GhostPack's Certify against your domain. Identify any template where low-privileged users can enroll and the template allows SAN for arbitrary subjects (ESC1 condition). Disable or reconfigure immediately.
- Hunt for default credentials. Scan all internet-facing applications and internal services for vendor-default or easily guessable credentials. Prioritize anything that can send email, execute code, or authenticate to identity infrastructure.
- Measure your alert noise. Pull last 30 days of SIEM alerts. What percentage are false positives? What's your mean time to triage? If analysts are dismissing alerts because they can't identify asset owners, that's an ownership and CMDB failure, not an analyst failure.
Strategic Actions
- Consolidate SOC operations or at minimum implement cross-SOC correlation. Multiple SOCs with different EDR stacks and no shared visibility is a structural vulnerability.
- Implement detection engineering as a discipline. This isn't 'tuning rules.' It's establishing baselines, defining what normal looks like for each asset class, and engineering alerts to surface only genuine anomalies. Invest in a detection engineer before you invest in a third analyst.
- Run purple team exercises that specifically test your SOC's ability to detect ESC1 abuse, SCCM-based lateral movement, and cloud credential theft. If your SOC can't detect these in a controlled exercise, they won't detect them when it matters.
- Map and document asset ownership. Every system in your environment should have a documented owner and business function. If your SOC can't answer 'whose system is this and what should it be doing,' they cannot distinguish attack from normal.
The CISA report is a gift. Two organizations, same attack, opposite outcomes. The lesson is sitting right there: detection and response maturity is not about buying more tools. It's about tuning the ones you have, consolidating visibility, and practicing until isolation is a reflex. Organization B proved it works. Organization A proved what happens when it doesn't.
