aa23-059a-cisa_red_team_shares_key_findings_to_improve_monitoring_and_hardening_of_networks

This Cybersecurity Advisory describes a red-team assessment at a large critical infrastructure organization, revealing persistent access, lateral movement, credential theft (including DCSync and golden tickets), and post-exploitation activities across multiple sites. It maps the attackers’ techniques to MITRE ATT&CK, documents command and control infrastructure, and provides mitigations and recommended security controls to improve monitoring, access controls, and the defense posture.