CISA identifies critical hygiene gaps at US critical infrastructure
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA's proactive threat hunt at a critical infrastructure organization found shared plaintext admin credentials, weak segmentation, and insufficient logging—no active compromise detected.
CISA and the U.S. Coast Guard conducted a proactive threat hunt at a critical infrastructure organization and identified significant cybersecurity risks, though no evidence of malicious actor presence was found. The most critical findings include shared local administrator accounts with identical non-expiring passwords stored in plaintext within batch scripts deployed across numerous workstations, enabling straightforward lateral movement. SCADA and HVAC systems lacked proper network segmentation, allowing standard user accounts direct access from IT networks via misconfigured firewall rules; designated bastion hosts lacked hardened configurations. Insufficient logging and log retention prevented comprehensive historical analysis and anomaly detection, hindering the hunt team's ability to identify sophisticated techniques that leave minimal artifacts.
Additional findings included misconfigured SSL/TLS settings on a production IIS server (sslFlags=='0') that disabled client-certificate enforcement and risked protocol downgrade attacks, and centralized SQL database credentials shared across all ASP.NET applications on a production server with minimum password lengths below NIST recommendations. The organization was not actively compromised, but these gaps represent a complete attack roadmap for lateral movement, persistence, and access to operational technology systems. CISA's recommendations prioritize unique credentials with MFA for administrative access, secure credential storage, proper IT/OT network segmentation with dedicated hardened bastion hosts, comprehensive logging with long retention, and modern TLS configuration hardening.
Detection guidance
Legacy SSL/TLS Protocol Enabled via SCHANNEL Registry
Registry change enabling SSL 2.0/3.0 or TLS 1.0/1.1 under SCHANNEL, weakening transport security and exposing the host to protocol downgrade attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Legacy SSL/TLS Protocol Enabled via SCHANNEL Registry
id: cfd7c05b-40ce-514d-a322-54bf360ad588
status: experimental
description: Detects registry changes that enable deprecated SSL/TLS protocol versions
(SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1) under the SCHANNEL Protocols key. Matches the
protocol-downgrade weakness described in the report, not a specific host.
tags:
- attack.defense-impairment
- attack.t1689
- attack.t1112
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- \SecurityProviders\SCHANNEL\Protocols\SSL 2.0\
- \SecurityProviders\SCHANNEL\Protocols\SSL 3.0\
- \SecurityProviders\SCHANNEL\Protocols\TLS 1.0\
- \SecurityProviders\SCHANNEL\Protocols\TLS 1.1\
TargetObject|endswith: \Enabled
Details: DWORD (0x00000001)
condition: selection
falsepositives:
- Administrators deliberately re-enabling legacy TLS for an old application that cannot
be upgraded
- Legacy compatibility baselines applied by configuration management tools
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-212a
IIS appcmd Modifying sslFlags Configuration
appcmd.exe used to set IIS configuration including sslFlags, which can disable client-certificate enforcement or weaken SSL requirements. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS appcmd Modifying sslFlags Configuration
id: b70b7ad0-9c4e-5877-9a5c-57c2849afc41
status: experimental
description: Detects appcmd.exe changing IIS configuration containing sslFlags, which
can remove SSL or client-certificate requirements on a site. Generalises on the
tool and setting, not a specific site name.
tags:
- attack.defense-impairment
- attack.t1112
- attack.t1689
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \appcmd.exe
CommandLine|contains|all:
- set
- config
- sslFlags
condition: selection
falsepositives:
- Web administrators legitimately configuring SSL bindings or client certificate requirements
during site deployment
- Automated IIS provisioning scripts
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-212a
Net Use to Administrative Share with Inline Credentials
net.exe use mapping a hidden administrative share with explicit /user: credentials, matching shared local admin accounts with plaintext passwords in batch scripts used for lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Net Use to Administrative Share with Inline Credentials
id: c4f6eb91-4027-58c7-85b0-2b7905ad3fae
status: experimental
description: Detects net.exe or net1.exe mapping a remote administrative share (C$,
ADMIN$ etc.) with credentials supplied on the command line. This pattern matches
batch scripts that embed shared local administrator passwords and enable lateral
movement.
tags:
- attack.lateral-movement
- attack.t1078.003
- attack.t1021
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \net.exe
- \net1.exe
CommandLine|contains|all:
- ' use '
- \\
- $
- '/user:'
condition: selection
falsepositives:
- Administrators or legacy logon scripts mapping admin shares with explicit credentials
for backup or software deployment
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-212a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-212a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs