Monday, 9:15. The first day of probability breach in a company with a valid ISO 27001 certificate, a five-analyst of five analysts and a 120-page security strategy. By 11:30 BloodHound has shown the way to Domain Admin through a service account svc_backup - Password Summer2021!It hasn't changed for three years. By 13:00 - full control over Active Directory. The company’s privileged access management policy took 47 pages and was agreed by the CISO quarter earlier.
Assumed breaches a scenario in which the attacker is already inside - through phishing, compromised contract accounting or insider. The SOC should detect such activity regardless of the penetration vector. In this project, I did not find.
Formal security vs real protection: where is broken, maturity security model
A typical assessment of the VIEVERing looks like this: the company takes the framework (NIST CSF v2.0, OWASP SAMM, its own scale 0-4), completes the questionnaire, receives a thermal map for domains - Identify, Protect, Detect, Respond, Recover. The level of maturity of security processes is fixed in the report, CISO plans the budget, the board of directors nods. Everyone's happy.
The problem is not the framework. The problem is the verification mechanism. NIST SP 800-53 Requires documented policies for each family of controls - AC-1 (Access Control), AU-1 (Audit), IR-1 (Incident Response). All three controls involve not only the development of documents, but also the procedures for their execution. Between "politics is written" and "policy is being implemented" - a chasm, which can be seen only with the pentest of the corporate network.
According to Liverton Security, the wording “No specified issues” in the scanner report creates a false sense of security. Compliance satisfies the auditor, but does not prove that the controls will withstand the real attack. The audit of security by the checklist and the imitation of attacks on infrastructure are two fundamentally different processes. The first checks what is written. The second one is that it works.
The financial implications of the gap between policy and practice are more specific. With the introduction of negotiable fines for repeated leaks of personal data (CaDP of the Russian Federation, Art. 13.11 in ed. Federal Law No420-FZ from 30.11.2024) the cost of discrepancies between the declared and real maturity is measured in tens of millions of rubles. On top - the cost of incident response, notification of the regulator. 3.1 of the article. 21 FZ-152 in ed. FZ-266 of 14.07.2022 obliges to send primary notification to RCN within 24 hours, the results of the internal investigation - within 72 hours) and reputational losses.
Failures of security strategy that opens the internal pentest
Five patterns that occur in every second element breach project. Each is on specific TTPs on MITRE ATT&CK and takes its place in the kill chain attack.
Preferred accounts without life cycle control
[Applicable to: Internal Pentest, Exambite / Grey Box - Editorial User Accounts Are Issued]
Place in kill chain: credential access -> privilege escalation -> lateral movement.
The script is standard. We get the domain-of-the-counter of an ordinary employee, run the BloodHound, we collect AD graph. The picture is repeated from the project to the project: service accounts with Domain Admin or Enterprise Admin rights, created for a specific task (backup, monitoring, integration with 1C) and forgotten. Passwords are static, often vocabulary.
This is Valid Accounts (T1078, Initial Access / Persistence / Privilege Escalation / Defense Evasion) in combination with Unsecured Credentials (T1552, Credential Access) The attacker does not need an exploit - he uses a legitimate account. For comparison: a vector from a related segment may require the exploitation of vulnerability like CVE-2026-8037 in Progress LoadMaster (CVSS 9.6, AV:A - an attack from a adjacent network, CWE-77 - OS Command Injection in the API; see the advisory Progress), but inside the perimeter everything is simpler - enough query to AD.
It is stated in the strategy: "All preferred accounts undergo quarterly audit, passwords change once every 90 days." In fact: svc_backup - Domain Admin, password has not changed 1100 days, the last interactive logogn is 2022.
Detection signal, which was not: a logog of a service account from a user's workstation instead of a dedicated server. In MaxPatrol SIEM, KUMA, or Elastic Security 8.x, this is one correlation rule - event ID 4624, LogonType 10 or 3, source host is not included in the whitelist server for this account. One rule. He was gone.
SIEM is - no detection
[Applicable to: internal pentest, assessment of the effectiveness of information security monitoring]
The place in kill chain: all stages - we check on which SOC will notice the activity of the attacker.
The company has invested tens of millions of rubles in SIEM. Licenses are active, the logs are collected, the Dashboards burn on the SOC screens. When checking security, it turns out: out of 200+ pre-set correlation rules, 12. Of these 12, half generates so many aerates that analysts have stopped responding to them. Alert fatigue in its pure form.
Start scanning of internal subnets nmap -sV - Network Service Discovery (T1046, Discovery) - hundreds of hosts pass without a single alert. Dumpitsa LSASS through rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump <lsass_PID> C:\temp\out.dmp full (In 2025, Defender/EDR is detected in behavior, but here EDR is silent) - OS Credential Dumping: LSASS Memory (T1003.001, Credential Access), plus Signed Binary Proxy Execution: Rundll32 (T1218.011, Defense Evasion) - silence.
NIST CSF v2.0, category DE.AE-01, requires installed baseline network operations and expected data streams. Without baseline, any altrate is noise, and the analyst ignores it.
For MaxPatrol SIEM and KUMA, there are ready-made content packs with rules for typical ATT&C equipment. For Elastic Security - built-in detection rules with a mapping. The problem is not the lack of tools, but that no one calibrated them for a specific infrastructure. The rule without a tuned baseline is a noise generator, no detection.
Backups that are not recovering
[Applicable: Precise: Essential, Resistance Check for ransomware, Destructive Scenario]
The place in kill chain: impact - we estimate whether the company will survive after destructive influence.
In the pre-briefing, CISO confidently declares: "Even if you encrypt everything, we have backups. RPO - 4 hours, RTO - 8". Please show the last recovery test. It's a pause. It turns out that the test recovery was carried out once - when the system was introduced two years ago. Since then, the infrastructure has grown, new databases have been added, and backup agent on three servers has ceased to work after updating the OS. No one noticed.
NIST SP 800-53, CP-1 (Contingency Planning), requires not just a recovery plan, but also a procedure for its regular verification.
In one of the projects, AD backups (ntds.dit) were stored on the same domain controller that we compromised. The attacker received both groceries and backups with one action. Isolation of backup infrastructure from the main domain - control that is declared in most information security strategies and is not regularly implemented in practice.
Network segmentation exists only on the diagram
[Applicable: internal pentest, offline movement, grey box]
Place in kill chain: lateral movement -> persistence.
Officially - VLANs, ACL's, DMZ, microsegmentation. In fact, from the work station of the accountant, all subnets are visible, including database servers and domain controllers. Remote Services (T1021, Lateral Movement) work without restrictions: RDP, SMB, WinRM - everything is open between segments. A beautiful scheme of the network in Visio, and in practice - a flat network.
According to Liverton Security, endpoints with Windows Server 2003 (end of support since 2015) are still found in infrastructure and are available on RDP without jump host and MFA. CISA and FBI together pointed to the audit inquiry RDP as the main enabler ransomware attacks. NIST SP 800-207 (Zero Trust) requires that no resource be considered trusted on the basis of a network location.
Start crackmapexec smb 10.0.0.0/8 --gen-relay-list targets.txt - the list of hosts without SMB Signing is often calculated in the hundreds. NTLM relay is possible from anywhere in the network. Segmentation? What a segmentation.
Passwords in scripts and GPO
[Applicable to: Internal Pentest, Credential Access,Infrastructure]
Place in kill chain: credential access -> privilege escalation.
Group Policy Preferences with passwords in cpassword - vulnerability, closed by Microsoft back in 2014 (MS14-025). On the pentests in 2025, we still find scripts in SYSVOL with cold-cut passwords, PowerShell automation with $password = "P@ssw0rd123" in open form, .xml files with scheduled credentials for tasks 2014. Eleven years have passed.
Bruter Force (T1110, Credential Access) often not required - Unsecured Credentials (T1552) are in public balls. One team - and the list of chord-made passwords is ready. TrustedSec describes a similar picture: vulnerability scanning replaces a full-fledged pentest, and such “low-tech” finds remain invisible to automatic scanners. The scanner does not look for passwords in scripts - it checks CVE.
Detection-checklist: Correlation rules for SOC
The minimum set of rules that should be triggered with a typical object bilithes. If more than half is missing, the assessment of the maturity of your company does not reflect reality.
Assumed breaches a scenario in which the attacker is already inside - through phishing, compromised contract accounting or insider. The SOC should detect such activity regardless of the penetration vector. In this project, I did not find.
Formal security vs real protection: where is broken, maturity security model
A typical assessment of the VIEVERing looks like this: the company takes the framework (NIST CSF v2.0, OWASP SAMM, its own scale 0-4), completes the questionnaire, receives a thermal map for domains - Identify, Protect, Detect, Respond, Recover. The level of maturity of security processes is fixed in the report, CISO plans the budget, the board of directors nods. Everyone's happy.
The problem is not the framework. The problem is the verification mechanism. NIST SP 800-53 Requires documented policies for each family of controls - AC-1 (Access Control), AU-1 (Audit), IR-1 (Incident Response). All three controls involve not only the development of documents, but also the procedures for their execution. Between "politics is written" and "policy is being implemented" - a chasm, which can be seen only with the pentest of the corporate network.
According to Liverton Security, the wording “No specified issues” in the scanner report creates a false sense of security. Compliance satisfies the auditor, but does not prove that the controls will withstand the real attack. The audit of security by the checklist and the imitation of attacks on infrastructure are two fundamentally different processes. The first checks what is written. The second one is that it works.
The financial implications of the gap between policy and practice are more specific. With the introduction of negotiable fines for repeated leaks of personal data (CaDP of the Russian Federation, Art. 13.11 in ed. Federal Law No420-FZ from 30.11.2024) the cost of discrepancies between the declared and real maturity is measured in tens of millions of rubles. On top - the cost of incident response, notification of the regulator. 3.1 of the article. 21 FZ-152 in ed. FZ-266 of 14.07.2022 obliges to send primary notification to RCN within 24 hours, the results of the internal investigation - within 72 hours) and reputational losses.
Failures of security strategy that opens the internal pentest
Five patterns that occur in every second element breach project. Each is on specific TTPs on MITRE ATT&CK and takes its place in the kill chain attack.
Preferred accounts without life cycle control
[Applicable to: Internal Pentest, Exambite / Grey Box - Editorial User Accounts Are Issued]
Place in kill chain: credential access -> privilege escalation -> lateral movement.
The script is standard. We get the domain-of-the-counter of an ordinary employee, run the BloodHound, we collect AD graph. The picture is repeated from the project to the project: service accounts with Domain Admin or Enterprise Admin rights, created for a specific task (backup, monitoring, integration with 1C) and forgotten. Passwords are static, often vocabulary.
This is Valid Accounts (T1078, Initial Access / Persistence / Privilege Escalation / Defense Evasion) in combination with Unsecured Credentials (T1552, Credential Access) The attacker does not need an exploit - he uses a legitimate account. For comparison: a vector from a related segment may require the exploitation of vulnerability like CVE-2026-8037 in Progress LoadMaster (CVSS 9.6, AV:A - an attack from a adjacent network, CWE-77 - OS Command Injection in the API; see the advisory Progress), but inside the perimeter everything is simpler - enough query to AD.
It is stated in the strategy: "All preferred accounts undergo quarterly audit, passwords change once every 90 days." In fact: svc_backup - Domain Admin, password has not changed 1100 days, the last interactive logogn is 2022.
Detection signal, which was not: a logog of a service account from a user's workstation instead of a dedicated server. In MaxPatrol SIEM, KUMA, or Elastic Security 8.x, this is one correlation rule - event ID 4624, LogonType 10 or 3, source host is not included in the whitelist server for this account. One rule. He was gone.
SIEM is - no detection
[Applicable to: internal pentest, assessment of the effectiveness of information security monitoring]
The place in kill chain: all stages - we check on which SOC will notice the activity of the attacker.
The company has invested tens of millions of rubles in SIEM. Licenses are active, the logs are collected, the Dashboards burn on the SOC screens. When checking security, it turns out: out of 200+ pre-set correlation rules, 12. Of these 12, half generates so many aerates that analysts have stopped responding to them. Alert fatigue in its pure form.
Start scanning of internal subnets nmap -sV - Network Service Discovery (T1046, Discovery) - hundreds of hosts pass without a single alert. Dumpitsa LSASS through rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump <lsass_PID> C:\temp\out.dmp full (In 2025, Defender/EDR is detected in behavior, but here EDR is silent) - OS Credential Dumping: LSASS Memory (T1003.001, Credential Access), plus Signed Binary Proxy Execution: Rundll32 (T1218.011, Defense Evasion) - silence.
NIST CSF v2.0, category DE.AE-01, requires installed baseline network operations and expected data streams. Without baseline, any altrate is noise, and the analyst ignores it.
For MaxPatrol SIEM and KUMA, there are ready-made content packs with rules for typical ATT&C equipment. For Elastic Security - built-in detection rules with a mapping. The problem is not the lack of tools, but that no one calibrated them for a specific infrastructure. The rule without a tuned baseline is a noise generator, no detection.
Backups that are not recovering
[Applicable: Precise: Essential, Resistance Check for ransomware, Destructive Scenario]
The place in kill chain: impact - we estimate whether the company will survive after destructive influence.
In the pre-briefing, CISO confidently declares: "Even if you encrypt everything, we have backups. RPO - 4 hours, RTO - 8". Please show the last recovery test. It's a pause. It turns out that the test recovery was carried out once - when the system was introduced two years ago. Since then, the infrastructure has grown, new databases have been added, and backup agent on three servers has ceased to work after updating the OS. No one noticed.
NIST SP 800-53, CP-1 (Contingency Planning), requires not just a recovery plan, but also a procedure for its regular verification.
In one of the projects, AD backups (ntds.dit) were stored on the same domain controller that we compromised. The attacker received both groceries and backups with one action. Isolation of backup infrastructure from the main domain - control that is declared in most information security strategies and is not regularly implemented in practice.
Network segmentation exists only on the diagram
[Applicable: internal pentest, offline movement, grey box]
Place in kill chain: lateral movement -> persistence.
Officially - VLANs, ACL's, DMZ, microsegmentation. In fact, from the work station of the accountant, all subnets are visible, including database servers and domain controllers. Remote Services (T1021, Lateral Movement) work without restrictions: RDP, SMB, WinRM - everything is open between segments. A beautiful scheme of the network in Visio, and in practice - a flat network.
According to Liverton Security, endpoints with Windows Server 2003 (end of support since 2015) are still found in infrastructure and are available on RDP without jump host and MFA. CISA and FBI together pointed to the audit inquiry RDP as the main enabler ransomware attacks. NIST SP 800-207 (Zero Trust) requires that no resource be considered trusted on the basis of a network location.
Start crackmapexec smb 10.0.0.0/8 --gen-relay-list targets.txt - the list of hosts without SMB Signing is often calculated in the hundreds. NTLM relay is possible from anywhere in the network. Segmentation? What a segmentation.
Passwords in scripts and GPO
[Applicable to: Internal Pentest, Credential Access,Infrastructure]
Place in kill chain: credential access -> privilege escalation.
Group Policy Preferences with passwords in cpassword - vulnerability, closed by Microsoft back in 2014 (MS14-025). On the pentests in 2025, we still find scripts in SYSVOL with cold-cut passwords, PowerShell automation with $password = "P@ssw0rd123" in open form, .xml files with scheduled credentials for tasks 2014. Eleven years have passed.
Bruter Force (T1110, Credential Access) often not required - Unsecured Credentials (T1552) are in public balls. One team - and the list of chord-made passwords is ready. TrustedSec describes a similar picture: vulnerability scanning replaces a full-fledged pentest, and such “low-tech” finds remain invisible to automatic scanners. The scanner does not look for passwords in scripts - it checks CVE.
Detection-checklist: Correlation rules for SOC
The minimum set of rules that should be triggered with a typical object bilithes. If more than half is missing, the assessment of the maturity of your company does not reflect reality.
