ISIS was once an insurgent guerrilla force. But no longer. ISIS is a conventional force. They have tanks, APCs, howitzers…. They can’t hide that aspect and remain a conventional force–they can move some small assets around, but not in numbers, and certainly not their heavier elements.
Seems to me that ISIS has left itself vulnerable to the same kinds of attacks that were used on Coalition forces–guerrilla style hit-and-run attacks, roadside ambushes. There is no deep security. Opposition would need only the ability to withdraw to the countryside and blend in, or, if unable to blend in, move far enough away with an ability to navigate the countryside (GPS?).
Look at the map above. There are a number of choke points that could be used to make a nightmare of their need to support themselves, tactically and logistically. Especially if a conventional force were to harass those “control zones” by way of distraction and harassment.