A Tale of Two SOCs: Insights From Two Red Team Assessments

MITRE Techniques

• [T1589.001 ] Gather Victim Identity Information: Credentials – The red team found a web application with default credentials that enabled internal email access. (‘identified a web application with default credentials’)
• [T1589.002 ] Gather Victim Identity Information: Email Addresses – The red team collected employee email addresses from public websites for spearphishing. (‘gathered email addresses from public websites’)
• [T1588.002 ] Obtain Capabilities: Tool – The red team used public tools for cloud reconnaissance. (‘including AzureHound and ROADrecon’)
• [T1566 ] Phishing – The red team used phishing emails to gain access to workstations. (‘sent phishing emails from an internal email address’ / ‘spearphishing emails’)
• [T1204 ] User Execution – Users clicked a malicious link or payload, enabling compromise. (‘users clicking on a malicious link’)
• [T1136.002 ] Create Account: Domain Account – The red team created machine accounts by abusing Machine Account Quota. (‘create machine accounts on a workstation’)
• [T1552 ] Unsecured Credentials – The red team found cleartext credentials on workstations and in cloud-related files. (‘located cleartext credentials on an administrative user’s workstation’)
• [T1552.001 ] Unsecured Credentials: Credentials In Files – The red team decrypted files and found passwords or IAM credentials stored in files. (‘connections.json and product-preferences.xml’ / ‘credentials in configuration files’)
• [T1003 ] OS Credential Dumping – The red team obtained cleartext credentials for MSOL and Entra accounts. (‘obtain cleartext credentials for cloud accounts’)
• [T1003.006 ] OS Credential Dumping: DCSync – The red team used DCSync to retrieve domain account credentials. (‘used DCSync to obtain AD account credentials’)
• [T1649 ] Steal or Forge Authentication Certificates – The red team abused misconfigured ADCS to request certificates for accounts. (‘request a certificate for the newly created machine account’)
• [T1087.002 ] Account Discovery: Domain Account – The red team scraped AD users. (‘query and scrape AD information, including AD users’)
• [T1018 ] Remote System Discovery – The red team enumerated computers in AD. (‘query and scrape AD information, including computers’)
• [T1069.002 ] Permission Groups Discovery: Domain Groups – The red team enumerated groups in AD. (‘query and scrape AD information, including groups’)
• [T1615 ] Group Policy Discovery – The red team enumerated GPOs. (‘query and scrape AD information, including GPOs’)
• [T1033 ] System Owner/User Discovery – The red team queried SCCM to map users to devices. (‘enumerate user-device relationships’)
• [T1526 ] Cloud Service Discovery – The red team enumerated Entra applications, permissions, and owners. (‘gather information about applications, their permissions, and their owners’)
• [T1550.001 ] Use Alternate Authentication Material: Application Access Token – The red team used an application access token to access emails. (‘retrieve and review target emails via the Microsoft Graph API’)
• [T1114 ] Email Collection – The red team reviewed and retrieved organizational emails. (‘review security operations center (SOC) staff emails’)
• [T1113 ] Screen Capture – The red team captured screenshots from SOC workstations. (‘captured screenshots’)
• [T1056.001 ] Input Capture: Keylogging – The red team used keyloggers on SOC workstations. (‘used keyloggers’)
• [T1213.005 ] Data from Information Repositories: Messaging Applications – The red team retrieved Teams messages. (‘retrieved Microsoft Teams messages’)
• [T1090.001 ] Proxy: Internal Proxy – The red team proxied tools through compromised workstations. (‘proxying tools through compromised workstations’)
• [T1021.004 ] Remote Services: SSH – The red team accessed a bastion host using SSH credentials. (‘log in over Secure Shell (SSH)’)
• [T1558 ] Steal or Forge Kerberos Tickets – The red team requested and used Kerberos tickets for impersonation and SSO abuse. (‘request a Kerberos service ticket’ / ‘asktgs module’)