SURIQ
Two critical infrastructure operators ran the same gauntlet at the same time. A CISA red team used near-identical tradecraft against both. One security team spotted the first phishing payloads, isolated the machines within a few minutes, and forced the testers to work blind. The other never noticed a thing, even as the testers read its analysts' email to check whether they had been caught. The gap between those two outcomes was not a bigger budget or a better product. It was whether the one signal that mattered could be seen and acted on.
CISA published the results on August 26 as advisory AA26-237A, and the detail worth sitting with is not the initial access. It is the split screen: two organizations, the same attack, opposite endings.
Why did one team catch the breach and the other miss it?
Both teams faced the same attack and the same underlying weaknesses. Organization B detected the initial phishing payloads as they ran and isolated the hosts within two to twenty minutes, cutting the testers off. Organization A ran more tools across separate teams, so the one real alert stayed buried under louder false positives. The difference was detection and response, not prevention.
| Control area | Org A (never detected) | Org B (contained in minutes) |
|---|---|---|
| Initial phishing payload | Read as routine noise | Flagged as each one executed |
| Host isolation | Never happened | 2 to 20 minutes, cut off C2 |
| Alert signal | Real alerts buried under higher-severity false positives | Tuned enough to surface the real one |
| SOC visibility | Several SOCs, separate EDR tools, no shared view | One shared view, pivoted to assume-breach |
| Response authority | Analysts could not act on what they saw | Isolated hosts on their own call |
The tools were there. The signal was not.
Organization A did not lose because it was under-instrumented. It ran multiple security operations centers with different endpoint tools and no shared view across them. Analysts were drowning in thousands of false positives, many rated at a higher severity than the alerts tied to the real intrusion. According to the advisory, a legitimate alert from the endpoint-management platform was written off as a false positive.
Here is the part the coverage skated past: more tooling made it worse. Splitting detection across separate teams with separate consoles is how you manufacture the noise that hides the one alert worth chasing. Alert fatigue is not an operations annoyance to be managed later. It is a failed control. An alert that fires and gets dismissed is functionally identical to an alert that never fired, and a defender who cannot escalate what they see is not really watching.
Every step the red team took was a loggable event
Walk the intrusion and note how ordinary each move is. In Organization A, the machine account quota still held its default value, so any domain user could stand up new machine accounts. A misconfigured Active Directory Certificate Services template carried the ESC1 flaw, so a low-privileged user could request a certificate that named an administrator as its subject. We wrote up the same class of certificate abuse earlier this year, and it keeps showing up because the template misconfiguration is common and quiet. Plaintext credentials sat in configuration files, and static AWS keys with no expiry sat in users' home directories, valid forever.
The cloud steps were no more exotic. The testers stole a Primary Refresh Token and abused over-permissioned Entra ID applications, the same identity-abuse pattern behind recent Entra token theft. In Organization B's path, a password sat in cleartext inside an XML file on an endpoint-management distribution point, and the testers abused single sign-on with Kerberos tickets pulled via DCSync to reach the cloud tenant without ever needing a password.
None of that is invisible. Adding a machine account, enrolling a certificate whose subject does not match the requester, minting a never-expiring cloud key, a sign-in from a freshly consented application: each is a discrete event a standard log pipeline records. The sensors to catch them ship in the platforms both organizations already ran. What Organization A lacked was one place to see those events and the tuning to make them stand out, not more coverage.
The attackers were reading the room
The single most instructive line in the advisory is how the red team confirmed it had gone undetected: it read the security team's email. Sit with that. The attacker had a live feedback loop on defender awareness, which let it move at leisure, escalate deliberately, and skip anything risky only when it chose to. Silence from the defender is an operational advantage the attacker will use.
Organization B took that advantage away. By catching the intrusion early and shifting to an assume-breach footing, it turned the engagement into a contest the testers had to fight for. Network segmentation on the operational side then blocked lateral movement even after the testers found the same weaknesses. This mirrors what works against real intrusions into critical infrastructure: you rarely prevent the first foothold, so the win is denying the quiet that lets a foothold become a takeover. Early, tuned detection of the initial delivery is what buys that.
Aggregate the signal, tune the noise, name who can pull the plug
The advisory lists concrete hardening steps, and they are worth doing today: set the machine account quota to zero unless a workflow genuinely needs it; turn off the option that lets an enrollee supply its own certificate subject (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT) and restrict who can enroll; strip cleartext credentials from workstations and network shares; give the endpoint-management platform the same protection as a domain controller as a Tier 0 asset; enable Conditional Access for workload identities and write a runbook to revoke tokens fast.
The harder fixes are organizational, and they are the ones that separated the two SOCs. Pull your telemetry into one place so no analyst is stuck with a partial view. Tune the pipeline so the real alert is not the quietest thing in the queue. And give at least one analyst the authority to isolate a host on their own judgment, without waiting for a meeting. The point of a managed detection service and disciplined threat hunting is exactly this: make sure the alert that matters is seen, and that someone is watching who can act before a foothold spreads. Organization A had the sensors. It did not have that.