CISA red team breaches critical infrastructure

Published August 20, 2026

CISA ran secret hacker-style tests against two critical infrastructure organizations to see how well their security teams would notice a real break-in. At one organization the testers read the security staff's own email and secretly recorded their keystrokes for weeks without being caught.

Report priority
High
Targets
Active Directory Certificate Services+1 more

How it works

CISA's testers first send phishing messages to get a foothold, then abuse a default Windows network setting that lets any user create new computer accounts, combined with a poorly locked-down internal certificate system, to turn that small foothold into full administrator-level control of the network without stealing a password.

What to do

Organizations should check whether their Active Directory still allows any regular user to create new computer accounts (the default Machine Account Quota setting) and whether certificate templates let low-privilege users request admin-equivalent certificates (the ESC1 weakness). Most home users and consumer software are not affected by this report.

CISA recommends setting the Machine Account Quota to zero for regular users, fixing ESC1-vulnerable certificate templates, forcing regular password and credential expiration on service and cloud accounts, turning on Conditional Access for application identities, and writing clear escalation procedures so real alerts are not dismissed as false positives.

Technical details

Affected software: Active Directory Certificate Services, System Center Configuration Manager

CISA testers send phishing messages to staff at a government services and facilities organization. Once inside, they exploit the default setting that lets ordinary users create computer accounts, plus a misconfigured certificate template, to grab administrator-level access. They move undetected into business systems and cloud accounts, eventually reading the security team's own email and secretly logging keystrokes on the defenders' machines without triggering a single alert.

CISA's 'A Tale of Two SOCs' report compares two red team engagements using nearly identical tradecraft: phishing for initial access, abuse of the default ms-DS-MachineAccountQuota setting to add rogue computer accounts, and ESC1-vulnerable AD Certificate Services templates to escalate to domain admin. In the deeper intrusion, testers harvested cleartext credentials from an SCCM file and ran DCSync attacks to pull domain controller credentials, including krbtgt, enabling forged Golden Tickets. The contrast came down to detection speed: one SOC's fragmented tooling and alert fatigue let the activity run for an extended period, while the other isolated infected hosts within 2 to 20 minutes and blocked a flagged Azure sign-in.

References

View Original Source