CISA Red Team Achieves Full Domain Control in Two Critical Infrastructure Entities via Default Credentials and AD CS Misconfigurations

CISA red team operators gained initial access to Organization A through default credentials on a public-facing web application, then escalated via default Machine Account Quota and an ESC1-misconfigured AD CS template identical to the Certighost technique. They extracted cleartext AWS keys and Entra ID Primary Refresh Tokens to reach sensitive business systems and security team mailboxes. No alerts were actioned across multiple disconnected SOCs despite thousands of higher-severity false positives.

Organization B's SOC isolated phishing executions within minutes and forced an assume-breach phase, yet the same underlying flaws persisted: SCCM-stored domain service credentials enabled DCSync, and an OT DMZ bastion host was reached. The contrast reveals that detection speed alone does not remediate credential exposure or certificate template weaknesses that predate both assessments.

Procurement records and prior CISA assessments show repeated AD CS and Machine Account Quota findings across federal and sector partners since 2022, indicating these are not isolated configuration errors but persistent patterns in environments with fragmented tooling and limited analyst authority. The advisory's emphasis on shared visibility gaps aligns with documented failures in multi-SOC critical infrastructure operators.

Next steps include mandatory AD CS hardening baselines in forthcoming CISA guidance and potential sector-specific mandates for credential vaulting and token revocation within 90 days of advisory publication.