cyber.hendryadrian.com
Security Insights · picussecurity.com

Federal Agency’s Assume-Breach Tests Find Detection Gaps Across Its Sites

· Original article ↗

Summary

A federal agency tested assumed attacker footholds site by site. Reviews found no successful lateral movement, but only about one in ten sites detected simulated activity, and hashes were retrievable on hosts with monitor-only endpoint agents.

Key points

  • The agency operates hundreds of sites within one Active Directory domain, with a three-person team managing validation.
  • Gray-box tests used supplied credentials and targeted one site subnet at a time; results were checked against SIEM and directory logs.
  • Scan reviews found no successful lateral movement from the initial foothold.
  • Only about one site in ten detected the simulated activity during early runs.
  • Credential hashes were retrievable from hosts where endpoint agents were in monitor-only mode.
  • The team currently installs testing agents manually and aims to automate site requests, setup, and testing.

Article Details

Topic
A US federal agency used Picus Autonomous Penetration Testing and Breach and Attack Simulation for site-by-site assume-breach testing, finding low detection rates and credential exposure on monitor-only hosts.

Vendors

PicusActive Directory domain, and a staff of three runs its validation program. Detection engineering had used Picus for more than a year when the red team took on a harder question: once an attacker is inside one site,

Products

Autonomous Penetration Testing (APV)The team added Autonomous Penetration Testing (APV) to Breach and Attack Simulation (BAS) and began gray-box, assume-breach runs scoped to one site’s subnet at a time. Network controls and the EDR held, with noBreach and Attack Simulation (BAS)The team added Autonomous Penetration Testing (APV) to Breach and Attack Simulation (BAS) and began gray-box, assume-breach runs scoped to one site’s subnet at a time. Network controls and the EDR held, with no

Related Articles