Introduction: The Perimeter Moved, the Controls Didn't

Most enterprises today are well-tooled. EDR runs on every endpoint, a secure web gateway inspects outbound traffic, and a SOC watches the alerts. On paper, the coverage is complete. In practice, attackers rarely test the control head-on. They walk around it.

Network and endpoint attacks were once loud: port scans, brute-forced logins, malware that triggered signatures on execution. Today's operations look different. They combine physical access, unmanaged peripherals, low-privilege scripting, portable virtual machines, browser extensions, and legitimate CDN infrastructure to move through environments that are, by every dashboard measure, fully protected.

Across multiple Red Teaming engagements SISA conducted between late 2024 and early 2026, one pattern consistently emerged: Attackers did not break the controls. They operated in the gaps between them. These findings point to a reality many organizations have not yet internalized: a deployed control is not an enforced control.

What SISA's Red Team Found During Network and Endpoint Simulations

1. No Network Access Control: An Ethernet Port Was Enough

One of the most consistent findings across engagements was the complete absence of network access control (NAC) on wired ports. Plugging a laptop into any available ethernet port granted an internal IP via Dynamic Host Configuration Protocol (DHCP) with no authentication challenge - no 802.1X, no Media Access Control (MAC) restriction, no posture check. From there, Domain Name System (DNS), Lightweight Directory Access Protocol (LDAP), and Server Message Block (SMB) shares were all reachable, and domain controller IPs surfaced within minutes through passive enumeration. Wi-Fi fared little better: networks were compromised through WPA2 handshake capture, password social engineering (through staff who shared the password without verifying identity), or through Active Directory (AD) credentials obtained via password spray and were used to authenticate to 802.1X networks.

Defensive priorities

• Enforce IEEE 802.1X across all wired and wireless ports and reject unauthenticated MAC addresses

• Enable Dynamic Host Configuration Protocol (DHCP) snooping and Dynamic Address Resolution Protocol (ARP) Inspection to block rogue devices

• Implement port-level MAC address binding and alert on new MAC addresses appearing on switch ports

• Segment guest and vendor Wi-Fi from the corporate network using VLAN isolation and firewall rules

2. Network Printers Were Handing Out the Internal Topology

Peripherals are rarely treated as assets, which is precisely what makes them valuable to an attacker. Across engagements, SISA found network printers accessible without authentication - in some cases from the internet, in others from the internal LAN. Their embedded web interfaces disclosed internal domain controller IPs, DNS servers, subnet details, Wi-Fi SSIDs, and firmware versions. In one engagement, a printer's administrative panel also controlled the building's access door schedules. The result was a complete network topology map, and a physical security control, obtained without touching a single corporate device.

Defensive priorities

• Segment printers into a dedicated VLAN with no internet exposure and restricted LAN access

• Set strong admin passwords and disable anonymous access to web management interfaces

• Patch printer firmware on a defined schedule - these vulnerabilities are well known and actively exploited

• Disable IPP and the embedded web server where not required, and firewall off management ports

3. Custom Malware Bypassed CrowdStrike, Trend Micro, and Zscaler

Endpoint detection performed as configured. It simply was not looking where the activity happened. Custom-crafted payloads, both Python-based and compiled, bypassed multiple deployed EDR solutions across red team engagements. Delivery required nothing exotic - a USB Rubber Ducky or a direct internet download. SmartScreen was bypassed by executing payloads through CMD rather than the GUI. PowerShell was available to low-privilege users and used for in-memory execution. In one of the more instructive cases, a portable Parrot OS virtual machine running AzureHound generated zero endpoint alerts.

Defensive priorities

• Restrict PowerShell to Constrained Language Mode for all non-admin users

• Block installation of Python, Node.js, and similar runtimes via Microsoft Store and winget

• Enable AMSI hardening for memory-based script detection

• Alert on VM process creation such as qemu, VMware, and VirtualBox on managed endpoints

• Enforce SmartScreen at the command-line level, not only at GUI execution

4. Browser Extensions and CDN Tunnels Walked Past the Secure Web Gateway

Egress controls assume traffic passes through them. Across multiple engagements that SISA carried out, it frequently did not. Browser VPN extensions were installed without administrative rights and routed traffic entirely outside Zscaler inspection. CDN-based tunnels carried command-and-control traffic through legitimate infrastructure that no proxy is inclined to block. Data was exfiltrated to paste sites, file-sharing platforms, and locally hosted HTTP servers, while Quick UDP Internet Connections (QUIC) traffic bypassed content filtering on several platforms.

Defensive priorities

• Enforce browser extension allowlisting and block all VPN and proxy extensions by policy

• Apply Cloud Access Security Broker (CASB) rules blocking paste sites, anonymous file upload services, and QUIC traffic

• Deploy outbound DLP with content inspection for HTTP POST on managed devices

• Monitor for local HTTP server creation, including python-m http.server patterns

SOC Playbook: Network Intrusion and Lateral Movement Detection

Once an attacker is inside the network, activity tends to resemble normal administrative work. Enumeration looks like inventory. Service ticket requests look like authentication. Scripted execution looks like automation. Perimeter-focused monitoring rarely catches any of it, because by that stage the perimeter has already been passed.

Based on patterns observed during SISA's Red Team engagements, security teams should prioritize detection and response around unauthorized device presence, directory enumeration, and unsanctioned egress.

Detection Priorities

Security teams should continuously monitor for:

1. New MAC addresses appearing on switch ports, including DHCP leases issued to unknown devices

2. Kerberos TGS requests for multiple service accounts from a single host in short succession - Event ID 4769, the Kerberoasting signature

3. PowerShell executing with encoded commands, IEX/IWR patterns, or from non-standard paths

4. Bulk LDAP queries from a single user account, an indicator of BloodHound-style AD enumeration

5. Outbound HTTP POST traffic to paste and file-upload domains outside the approved list

Response Priorities

When network intrusion is suspected:

1. Isolate the endpoint immediately on a confirmed EDR bypass or an unknown process opening outbound connections

2. On a Kerberoasting alert, identify the targeted service accounts, rotate their passwords immediately, and audit SPN registrations

3. On LDAP enumeration, restrict the source account, review what was accessed, and identify likely lateral movement targets

4. Block the source IP at the perimeter, push updated EDR signatures, and take a full forensic image if an advanced threat is confirmed

Final Perspective

None of the findings above required advanced tradecraft. They required a laptop, physical or credential-based access, and a working understanding of how enterprise networks are typically built - a threat population considerably larger than the one most security programs are designed around.

The findings from SISA's Red Teaming engagements reinforce a critical reality: organizations validate that controls exist, while attackers test whether controls hold. A compliance check confirms 802.1X is licensed. An adversary simulation confirms whether it is enforced on the port in the third-floor meeting room.

This changes what enterprise security operations must look like. Organizations need continuous control validation that combines network access enforcement, peripheral and asset governance, endpoint execution controls, egress path monitoring, and regular adversary simulation. Because in modern enterprise environments, the gap is rarely in the tooling. It is in the assumption that deployment equals defense.

‍