AI Agent Went from a Plugin to a Top Manager's Disk: Defense Caught 14 of 15 Steps

⚡ The Gist in 5 Seconds

• Positive Technologies ran a RedTeam AI agent through a corporate network: it went from a vulnerable plugin on a web server all the way to a top manager's disk.
• A comprehensive ML/AI defense built on MaxPatrol SIEM caught 14 of 15 steps — without rules written for specific tools.
• The author of the test himself warns: one scenario, one lab — the conclusions don't hold beyond it.

🔍 What Happened

PT ESC lead expert Alexey Potapov described the experiment in a lab setting. The RedTeam AI agent was given a task: reach the documents of a top manager at a small company via the corporate network. The route: a vulnerable plugin on a web server, then a mail server, a domain controller, and the executive's host. At the final step, the agent viewed the contents of the disk. The entire path took several hours, proceeded with operator hints, and on the three compromised servers the agent set up tunnels and moved onward through them.

Here's how the defense worked. The MaxPatrol BAD (Behavioral Anomaly Detection) module collects, normalizes, and filters anomalies — deviations from the normal behavior of processes and users. These are behavioral indicators, IoB. Then HackTracker comes into play: an ML classifier layered on top of BAD, which outputs True or False. The classifier doesn't know specific tools and provides no explanations for its verdict — the model was deliberately optimized for accuracy. Explaining the verdict is the job of the PT Naira AI assistant: the analyst selects a chain of processes, and Naira consolidates the events into a write-up. Four components took part in the test in total; the fourth is not named in the publicly available excerpt of the article.

The author's main point: rules tied to a specific tool, technique, or log line no longer save you. The agent swaps tools, file names, ports, and obfuscation on the fly. But the behavioral footprint remains at almost every step. Potapov separately notes that an LLM can't handle the raw SIEM event stream — it needs a pre-filter to narrow the context. And not every anomaly means an attack: administration, infrastructure changes, and rare legitimate scenarios look similar.

🧠 Our Take

What makes this test interesting to me isn't the 14 out of 15 figure, but the shift in logic. SOC used to live on rules: here's the tool, here's its log line, here's the detection. Against an agent, that scheme falls apart — by the time an analyst writes a rule, the agent has already switched to another tool. It looks like an attempt to move detection from identifying marks to habits. Our assessment: the direction is right, because an AI agent fakes identifying marks faster than habits.

What this changes for people. The workload on first-tier analysts will grow: the event stream isn't going anywhere, and interpreting ML model verdicts without explanations is a different skill. That's exactly why Naira is in the scheme: not to replace the human, but to give them text instead of True/False.

Who wins. Vendors that have both a SIEM and an ML layer inside a single product — it's easier for them to show such a combo in a demo. Losers, in our assessment, are teams that rely on hand-written rules and SigMA-like rule sets: they'll have to rebuild. But an honest caveat: the test was run by the vendor on its own product, and that changes the stakes.

⚠️ What We Don't Know

The most important practical data is missing: the false positive rate, the number of events before and after pre-filtering, and the response time per step. The author himself writes that this is one scenario in one lab, and at the end of the article explains what the result does not prove — that part is not included in the publicly available excerpt. Another nuance: the agent moved with operator hints. How autonomous the attack actually was remains an open question, and without an answer to it, "AI vs. AI" easily turns into "a human with an advanced script vs. an ML model." This should be verified in independent tests, not vendor-run ones.

Prediction: within a quarter, at least one public report from another SIEM vendor will come out with a similar "AI agent vs. ML defense" scenario. Not all false positive metrics will be disclosed — security feeds will make that clear.

Source: Habr / Positive Technologies