If your network defenders can't see a threat, you can't stop it. CISA recently conducted parallel red team assessments that revealed why two organizations with similar technical stacks had radically different outcomes: one suffered a full domain compromise undetected, while the other isolated the threat within hours. The difference wasn't budget or tooling, it was detection readiness.
This checklist helps you audit whether your security operations center can actually see and respond to threats, not just collect alerts.
Focus of This Checklist
This isn't about buying more tools. It's about ensuring the detection and response capabilities you already own can function when an attacker enters your environment. You'll validate that your baselines exist, your teams can communicate across silos, and your cloud controls match your on-premises rigor.
Use this before your next red team exercise, penetration test, or tabletop. Each item maps to failures CISA observed in Organization A or successes they documented in Organization B.
Prerequisites
Before you start:
- Access to your SIEM or security monitoring platform to review alert volumes and tuning status
- Documentation of your incident response procedures, including escalation paths and authority boundaries
- Inventory of cloud workload identities (service principals, managed identities, IAM users)
- Current network segmentation diagrams showing SBS locations and access paths
Detection Readiness Checklist
1. Alert Baseline Exists and Is Current
Check: Can you define normal for each critical system? Do you have documented baselines for AD queries, authentication patterns, certificate requests, and lateral movement between network segments?
What good looks like: Your SOC maintains quantified baselines (e.g., "normal certificate requests per hour: 5-12") updated within the past 90 days. When BloodHound-style AD enumeration runs, it triggers an alert because it exceeds baseline query volumes.
2. Alert Tuning Reduces False Positives to Actionable Volume
Check: What percentage of your alerts result in investigation? If your team sees 500+ alerts daily but investigates fewer than 10, your signal-to-noise ratio prevents real threat detection.
What good looks like: Your SOC investigates at least 15% of alerts. Routine events (software updates, scheduled scans) are filtered before they reach analysts. Organization B's defenders could act quickly because they weren't drowning in noise.
3. EDR Signatures Updated for Evasion Techniques
Check: When was the last time you tested whether modified versions of common tools (BloodHound, Mimikatz, Cobalt Strike) bypass your EDR? Static signatures fail against customized tooling.
What good looks like: You run quarterly evasion tests using modified versions of common attack tools. Your detection relies on behavioral indicators (unusual process trees, memory access patterns) not just file hashes.
4. Active Directory Certificate Services Templates Audited
Check: Run a scan for ESC1-ESC8 ADCS misconfigurations. Can unprivileged users request certificates for privileged accounts?
What good looks like: No certificate templates allow Subject Alternative Name (SAN) specification by requesters. All templates require manager approval for privileged account certificates. You audit certificate requests weekly for anomalies. (CISA's red team exploited ESC1 misconfigurations for privilege escalation.)
5. Machine Account Quota Restricted
Check: What's your domain's MAQ setting? The default of 10 allows any authenticated user to add computer accounts, a common privilege escalation path.
What good looks like: MAQ is set to 0 for standard users. Only designated service accounts can add computer accounts, and each addition triggers a security review. CISA's red team created machine accounts to exploit ADCS misconfigurations.
6. Incident Response Authority Clearly Defined
Check: Can your SOC analysts quarantine a workstation without waiting for approval? What about isolating a database server? A cloud application?
What good looks like: Your incident response playbook specifies decision authority at each severity level. Analysts can isolate endpoints immediately. Organization B's defenders quarantined compromised systems within hours because they had clear authority.
7. Cross-Team Communication Paths Tested
Check: When did your SOC last coordinate with your cloud team, database administrators, and OT engineers during an incident? Can they reach each other outside business hours?
What good looks like: You run quarterly tabletop exercises that require coordination across IT, cloud, and OT teams. Contact lists are current. Escalation paths don't require navigating bureaucratic approval chains during active incidents.
8. Cloud Workload Identities Have Conditional Access Policies
Check: Do your service principals and managed identities operate under the same access controls as user accounts? Can an application with elevated Microsoft Graph permissions operate from any IP address at any time?
What good looks like: You've implemented Conditional Access for workload identities. Service principals with sensitive permissions (Mail.ReadWrite, User.ReadWrite.All) are restricted by IP range and monitored for unusual activity. CISA's red team exploited unrestricted application permissions.
9. Cloud Credential Expiration Enforced
Check: Do you have long-lived AWS IAM user credentials or Azure service principal secrets that never expire? Are they stored in configuration files on user workstations?
What good looks like: All cloud credentials rotate at least every 90 days. IAM users are replaced with temporary credentials or federated access. Configuration files containing credentials trigger DLP alerts. (CISA found static AWS credentials in user home directories.)
10. Virtual Desktop Infrastructure Doesn't Bypass Controls
Check: If you use virtual desktops for accessing sensitive systems, can attackers compromise the DFS root to access all users' files simultaneously?
What good looks like: Virtual desktop file shares are segmented by user group. Root DFS drives don't contain user credential material. You monitor DFS access for bulk file enumeration. Organization A's red team compromised thousands of virtual desktops through a single DFS root.
11. Credential Material Scanned on Endpoints
Check: Are database connection strings, API keys, or cloud credentials stored in cleartext in config files, browser storage, or application preference files on user workstations?
What good looks like: You run weekly scans for credential patterns in user directories. Findings trigger automatic remediation (credential rotation) and user training. CISA's red team found SQL passwords in product-preferences.xml files.
12. Token Revocation Procedures Documented for Cloud Compromise
Check: If an attacker obtains a valid OAuth refresh token or session token for your cloud environment, how long does it take your team to identify and revoke all active tokens for that identity?
What good looks like: Your incident response runbook includes step-by-step token revocation procedures for Microsoft Entra ID, AWS, and other cloud platforms. You've tested these procedures in the past six months.
Common Mistakes
Assuming detection tools work without tuning. Organization A had EDR and SIEM deployed but failed to detect any red team activity because alerts weren't tuned and baselines didn't exist.
Treating cloud environments as lower risk. Both organizations had weaker controls in cloud environments than on-premises. Attackers moved to cloud resources after compromising on-premises systems.
Separating security teams by technology domain. Silos between IT security, cloud security, and OT security prevented coordinated response. Organization B succeeded partly because defenders could communicate across these boundaries.
Relying on network segmentation alone. Virtual desktops and cloud applications bypass traditional network controls. You need application-layer monitoring and access policies.
Next Steps
After completing this checklist:
Prioritize gaps by attacker value. Start with items that protect paths to your SBSs, Active Directory, privileged credentials, and cloud access.
Test your fixes with purple team exercises. Have your red team or penetration testers validate that your tuning actually detects the techniques you're concerned about.
Measure time-to-detect and time-to-contain. Organization B's success wasn't perfect detection, it was rapid containment. Track these metrics monthly.
Review quarterly. Attackers adapt. Your baselines, tuning, and procedures need regular updates to remain effective.
The difference between Organization A and Organization B wasn't technical capability, it was operational readiness. Your detection tools only work if they're tuned, your teams can communicate, and your responders have authority to act.
