Agentic AI Attack & Defense Junior - 2 days - 2500€ HT
Description
In September 2025, a Chinese state-linked group used Claude Code and the Model Context Protocol (MCP) to autonomously conduct cyber espionage against approximately 30 organizations across technology, finance, and government sectors. The agent handled 80 to 90 percent of tactical operations independently: reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and data categorization by intelligence value. It used entirely open-source tools. No custom malware. No zero-days. One month later, NodeZero solved GOAD in 14 minutes, a task that takes human experts 12 to 16 hours. XBOW reached first place on HackerOne's global leaderboard with over 1,060 autonomous vulnerability reports.
Agentic AI is not a research topic anymore. It is an operational reality that is reshaping what both attackers and defenders can do, and how fast they can do it. The marginal cost of running cyber-attacks is approaching zero.
This two-day training covers both sides of that shift. On the offensive side, participants build an AI agent from scratch and wire standard penetration testing tools (nmap, Impacket, NetExec, BloodHound, Sliver) to it via the Model Context Protocol (MCP), then run it against a realistic Active Directory environment. They learn to write skills that make the agent reliable, hooks that make it resilient, and engagement contracts that keep it in scope. On the defensive side, participants wire the same architecture to a SIEM and use it to hunt the attack they just executed, generate and tune Sigma detection rules, score their detection coverage, and build automated posture monitoring pipelines. The same MCP model that drives offensive agents drives defensive ones: understanding both is the point of the course.
A dedicated module covers MCP security itself, covering how agents become attack surfaces through shell injection, tool description poisoning, and indirect prompt injection via target content, with hands-on exploitation of published CVEs. The training closes with a section on hybrid human-AI engagement design: where to draw the autonomy line, how to structure approval gates, and which judgment calls remain irreducibly human.
Labs run throughout all two days against an Active Directory environment. Participants complete a realistic kill chain through several distinct vulnerability classes, watch their agent run it autonomously in a capstone exercise, then switch sides to detect and write rules for techniques they just exploited.
Objectives
- Understand the mechanics of offensive and defensive AI agents from the model and harness to the Model Context Protocol (MCP)
- Build an autonomous intrusion agent, equip it with standard penetration testing tools, and execute it against a realistic Active Directory environment
- Adapt the same architecture for defense to track the attack, generate Sigma detection rules, and assess coverage
Public and prerequisites
This training is suitable for Red Teamers and pentesters wanting to integrate AI agents into offensive operations, SOC analysts and blue team practitioners responsible for detection engineering, security engineers building or evaluating AI-powered security tooling, or consultants wanting to understand and quantify the threat posed by offensive AI agents.
-
Pentesters / Red Teamers
-
SOC analysts and blue team engineers
-
Security engineers
Fluent UNIX/Linux skills, networking basics, and an interest in offensive and defensive security are highly recommended.
-
No prior AI or LLM experience required, model internals are covered from scratch
-
Python scripting ability (the training involves modifying MCP server code)
-
Basic networking knowledge (TCP/IP, DNS, HTTP)
-
Understanding of core AD concepts (Kerberos, NTLM, RBAC, LDAP)
-
Familiarity with common Active Directory attacks
Content
Day 1
Foundations: what an LLM really is (next-token prediction, not reasoning), hallucination and confabulation risks in offensive ops (fabricated credentials, false findings, lockout), determinism, the Claude model family (Opus supervisor, Sonnet team leader, Haiku operator), context window mechanics (stateless calls, attention degradation, silent overflow). The stack: three independently-failing layers (model, harness, MCP), OpenCode harness (AGENTS.md, hooks, audit log, model routing, cost tracking), MCP fundamentals (stdio vs HTTP/SSE, tool discovery, function calling, structured output), local and air-gapped inference. MCP security: the three dominant failure modes (shell injection, missing allowlist, missing timeout), hands-on exploitation (remote shell injection CVE-2025-54136 class, tool description injection, output poisoning), the safe pattern (CIDR allowlist, profile-based flag allowlist, structured JSON, per-call timeout). Prompt architecture: AGENTS.md as engagement contract, hooks (credential capture, anti-loop, OPSEC rate limiter, state summarizer), state file design, skill writing (explicit invocation, verification blocks, few-shot, retry limits), AD techniques at protocol level (Kerberoast, AS-REP roasting, Pass-the-Hash, DCSync), agent failure modes and fixes. Killchain & trace reading: the EDR paradox, scenario matrix (blackbox / assumed breach / whitebox), killchain walkthrough (LDAP recon to DCSync, SOCKS pivot, C2 via Sliver), OPSEC rules in code. Live lab - first paths: first two attack paths with a solo single-tier agent, individual trace-reading exercise with detection mapping.
Day 2
Multi-agent architecture: why single agents fail at scale (context math, attention degradation, the lost middle), three-tier design (Supervisor/Opus decisions only, Team Leader/Sonnet phase planning, Operator/Haiku single call then destroyed), context isolation, triage module (scope check, deduplication, MITRE validation). Memory systems: four memory types and their implementations (episodic state.json, semantic long-context vs RAG, procedural skills on disk with hot-editing), framework patterns (ReAct, graph state machine, supervisor/swarm, code-as-action) and when each fails. Live lab - remaining paths & capstone: last two attack paths with the three-tier architecture, autonomous capstone (full killchain unsupervised, audit-log monitoring), debrief on timing and suboptimal choices. Blue team agent: wiring to Elasticsearch via MCP (index discovery, ESQuery, timeline reconstruction), automated threat hunt (SPN enumeration, LSASS access, RC4 Kerberos, lateral WinRM), mapping offensive MCPs to defensive equivalents. Sigma & detection coverage: Sigma fundamentals, agent-generated rules from findings.md (one per MITRE technique, with tuning notes), false-positive tuning in practice, SIEM conversion (Splunk SPL, Elastic KQL, Sentinel via mcp-sigma), red/blue validation loop, coverage scoring (default ~40%, with Sysmon/LDAP auditing/EDR 80-85%), the unsolved intent-detection problem. Automation, reporting & human irreducibles: business case (frequency over accuracy), pipeline shape and gate logic (out-of-scope halt, immutable audit log, auto teardown), cost optimization (model routing 60-80% savings, prompt caching), finding format and report QA, the four-phase hybrid workflow, human irreducibles and final effectiveness debrief.
All the details regarding how the training is conducted are described on this page.