Back to catalogBlue vs. Red with AI:
From Attacker Playbooks to Defender Detections
Follow attacker playbooks, investigate the evidence, and build detections you can validate.
Duration: 4 Days (Hands-on labs + Capstone)
Format: Instructor-led bootcamp
Level: Intermediate / PractitionerAVAILABILITY
Past delivery: DEF CON Training Las Vegas 2026. New cohort dates to be announced.
This delivery has concluded. Inquire about private team training or future public cohorts.
Intended audience
SOC analysts and tier-1/2 triage engineers seeking deep telemetry correlation- Threat hunters and detection engineers looking to turn behavior into tested Sigma/detection logic
- Incident responders wanting realistic timeline building and forensic reasoning
- Security engineers and team leads evaluating practical, responsible AI adoption in defensive workflows
Prerequisites & equipment
- Comfort with basic Linux command line and terminal navigation
- Fundamental understanding of networking (IP, ports, DNS, HTTP, authentication)
- Familiarity with enterprise SOC concepts (alerts, logs, indicators, evidence)
- Laptop capable of browser-based labs, SSH, and RDP access (min 16 GB RAM recommended for local backup options)
SYLLABUS
Four days of intensive practice
Foundations: How Attacks Become Signals
Lab readiness, endpoint and Zeek baselines, telemetry correlation, attack-to-evidence mapping, and AI-in-the-loop analyst workflows.
Module topics
- •Sysmon and Windows Event Log baselines
- •Zeek network connection and protocol parsing
- •Distinguishing normal administrative noise from suspicious execution
- •Initial Sigma rules and baseline query drafting
- •Human-in-the-loop AI assistance: prompt hygiene and hypothesis generation
Red Team Basics: Build Empathy for the Adversary
Initial access patterns, execution, persistence mechanisms, LOLBAS artifacts, and understanding the forensic traces attacker actions create.
Module topics
- •Phishing triage and malicious payload analysis
- •LOLBAS (Living-off-the-Land Binaries) analysis (mshta, BITSADMIN, certutil)
- •Persistence techniques and scheduled task execution
- •Artifact analysis across file systems, registry, and memory traces
- •Mapping adversary techniques directly to MITRE ATT&CK
Blue Team Operations: Hunt, Detect, and Respond
Command-and-control beacon investigation, lateral movement across Windows environments, timeline reconstruction, and Elastic-based hunting.
Module topics
- •C2 beacon detection and network telemetry inspection
- •Lateral movement analysis (WinRM, SMB, WMI)
- •Incident timeline building: chronologically linking disparate events
- •Hypothesis-driven threat hunting in Elastic / OpenSearch
- •Developing defensible response steps and isolation recommendations
Capstone: From Attack Story to Defender Action
Synthesize full-scope adversary activity into validated detections, write executive-ready technical briefings, and map emerging AI pipeline risks.
Module topics
- •End-to-end multi-stage intrusion investigation
- •Transforming findings into tested, production-grade Sigma rules
- •AI pipeline security, prompt injection response, and MITRE ATLAS mapping
- •Clear analyst communication: producing defensible incident findings
- •Final challenge debrief and repeatable analyst playbooks
Lab approach
Hands-on investigations in realistic telemetry environments. Students use hosted OpenSearch clusters, Jupyter notebooks with MSTICpy, interactive CTF challenge platform, and guided playbooks. Grounded in observable logs and evidence, with AI used strictly as a hypothesis accelerator that requires manual human validation.
AI principle
AI accelerates hypotheses and drafts; the analyst validates every conclusion against observable evidence.
What you take away
- The ability to trace raw attacker commands down to exact endpoint and network artifacts
- Tested Sigma detection engineering workflows you can implement inside your organization
- Defensible incident timeline reconstruction techniques
- Framework for using local/private AI responsibly without leaking sensitive customer or company data
- Repeatable investigation checklists and field manual references
Instructors
Carlo Anez Mazurco
Instructor · CTI, Detection & AI-Assisted Defense
Practitioner and educator focused on cyber threat intelligence, detection engineering, and responsible AI-assisted SOC workflows. Instructor of Blue vs. Red with AI at DEF CON Training Las Vegas 2026.
Ready to go deeper?
Request a private delivery for your team or explore our free resources to start today.