AI agent went from WordPress to an executive's drive, and the defense caught 14 of 15 steps

Classic defense lives on rules: spot a familiar tool or a string in a log, raise an alert. An attacking AI agent breaks that model. Tools, file names, ports and obfuscation techniques are just variables to it, and it changes them on the fly. While an analyst writes a rule for one utility, the agent has already picked another. On top of that, it is hard for people to work through a stream of alerts at the pace a machine sets.

Positive Technologies experts tested on a lab bench whether a behavioral approach helps. A RedTeam agent imitating an attacker was given a goal: get to an executive's documents. The defense was not tuned to the lab.

How the agent moved through the network

The bench looked like a small corporate network: WordPress on the perimeter, Exchange mail, a domain controller, an ADCS certificate server and workstations. The operator gave hints, but the agent chose the steps and tools itself. The attack took several hours.

It started with a vulnerable WordPress plugin and the upload of a PHP web shell. Then it exploited a sudo misconfiguration: awk can be run without a password, and through it any command executes as root. That produced the first tunnel. Next, via ProxyLogon, it took Exchange, set up a second tunnel, obtained a certificate through a vulnerable ADCS template (ESC1), dumped the domain hashes using DCSync and forged a Kerberos Golden Ticket. The domain controller became the third foothold, after which the agent went through six workstations and browsed the executive's drive.

The key technique here is pivoting: a captured server becomes a SOCKS5 proxy, and further traffic originates from its address. There were three in total. The network perimeter is not bothered by such traffic, because it comes from inside.

What the defense had

The setup has two layers. MaxPatrol BAD, an ML module within the SIEM, selects anomalies: deviations in process and user behavior regardless of the tool. These are called behavior indicators. It acts as a prefilter, because an LLM cannot process the raw SIEM event stream on its own.

The second layer is classification, since not every anomaly means an attack. HackTracker receives a behavior description from BAD and issues a verdict: malicious or legitimate. It does not know specific tools, and it deliberately gives no explanations, for the sake of accuracy. Explanations come from PT Naira, an AI assistant that analyzes the process chain the analyst selects, and from an internal AI agent for BAD, which receives detections with normalized events. The agent is not yet a product but a demonstration.

The Exchange example shows how it works. The IIS application pool spawns powershell.exe with a hidden window and no profile, followed by an AMSI bypass, disabling of script logging and removal of the read-only attribute from the web shell. Each action on its own can be legitimate, but the chain forms a hacking pattern. The tunnel is caught the same way: certutil downloads a file, which masquerades as svchost32.exe and connects to C2 with SOCKS parameters.

On the Unix host with WordPress the picture is different. HackTracker so far only works with Windows events, so the verdict there was built by BAD indicators and the AI agent: a shell from apache2, reconnaissance from www-data, a binary download into /tmp, sudo escalation via an interpreter.

What follows from this

The practical takeaway is simple: detect behavior chains, not utility names. If a defense relies on signatures of specific tools, an AI agent will bypass it simply by switching software. Meanwhile, a human still has to review every detection, and an LLM explainer cuts the time to a verdict. It is also worth checking the mundane things the agent used as stepping stones: passwordless sudo for awk, an unpatched Exchange, vulnerable ADCS templates.

Keep the limitations in mind. This is one scenario in one lab, run by the vendor itself. The "14 of 15" result says nothing about the false positive rate in a live network with thousands of admins and complex infrastructure. HackTracker's Unix coverage is still incomplete, and the AI agent has not yet been released as a product. The test shows that an AI attack leaves a behavioral trace, but it does not prove the defense will work the same way in your network.