Volver al catálogoBlue vs. Red with AI:
From Attacker Playbooks to Defender Detections
Follow attacker playbooks, investigate the evidence, and build detections you can validate.
Duración: 4 Days (Hands-on labs + Capstone)
Formato: Instructor-led bootcamp
Nivel: Intermediate / PractitionerDISPONIBILIDAD
Past delivery: DEF CON Training Las Vegas 2026. New cohort dates to be announced.
Esta entrega ha concluido. Consulta por formación privada para equipos o futuras cohortes públicas.
Audiencia objetivo
SOC analysts and tier-1/2 triage engineers seeking deep telemetry correlation- Threat hunters and detection engineers looking to turn behavior into tested Sigma/detection logic
- Incident responders wanting realistic timeline building and forensic reasoning
- Security engineers and team leads evaluating practical, responsible AI adoption in defensive workflows
Requisitos previos y equipo
- Comfort with basic Linux command line and terminal navigation
- Fundamental understanding of networking (IP, ports, DNS, HTTP, authentication)
- Familiarity with enterprise SOC concepts (alerts, logs, indicators, evidence)
- Laptop capable of browser-based labs, SSH, and RDP access (min 16 GB RAM recommended for local backup options)
PLAN DE ESTUDIOS
Cuatro días de práctica intensiva
Foundations: How Attacks Become Signals
Lab readiness, endpoint and Zeek baselines, telemetry correlation, attack-to-evidence mapping, and AI-in-the-loop analyst workflows.
Temas del módulo
- •Sysmon and Windows Event Log baselines
- •Zeek network connection and protocol parsing
- •Distinguishing normal administrative noise from suspicious execution
- •Initial Sigma rules and baseline query drafting
- •Human-in-the-loop AI assistance: prompt hygiene and hypothesis generation
Red Team Basics: Build Empathy for the Adversary
Initial access patterns, execution, persistence mechanisms, LOLBAS artifacts, and understanding the forensic traces attacker actions create.
Temas del módulo
- •Phishing triage and malicious payload analysis
- •LOLBAS (Living-off-the-Land Binaries) analysis (mshta, BITSADMIN, certutil)
- •Persistence techniques and scheduled task execution
- •Artifact analysis across file systems, registry, and memory traces
- •Mapping adversary techniques directly to MITRE ATT&CK
Blue Team Operations: Hunt, Detect, and Respond
Command-and-control beacon investigation, lateral movement across Windows environments, timeline reconstruction, and Elastic-based hunting.
Temas del módulo
- •C2 beacon detection and network telemetry inspection
- •Lateral movement analysis (WinRM, SMB, WMI)
- •Incident timeline building: chronologically linking disparate events
- •Hypothesis-driven threat hunting in Elastic / OpenSearch
- •Developing defensible response steps and isolation recommendations
Capstone: From Attack Story to Defender Action
Synthesize full-scope adversary activity into validated detections, write executive-ready technical briefings, and map emerging AI pipeline risks.
Temas del módulo
- •End-to-end multi-stage intrusion investigation
- •Transforming findings into tested, production-grade Sigma rules
- •AI pipeline security, prompt injection response, and MITRE ATLAS mapping
- •Clear analyst communication: producing defensible incident findings
- •Final challenge debrief and repeatable analyst playbooks
Enfoque de laboratorio
Hands-on investigations in realistic telemetry environments. Students use hosted OpenSearch clusters, Jupyter notebooks with MSTICpy, interactive CTF challenge platform, and guided playbooks. Grounded in observable logs and evidence, with AI used strictly as a hypothesis accelerator that requires manual human validation.
Principio de IA
La IA acelera hipótesis y borradores; el analista valida cada conclusión contra la evidencia observable.
Lo que te llevas
- The ability to trace raw attacker commands down to exact endpoint and network artifacts
- Tested Sigma detection engineering workflows you can implement inside your organization
- Defensible incident timeline reconstruction techniques
- Framework for using local/private AI responsibly without leaking sensitive customer or company data
- Repeatable investigation checklists and field manual references
Instructores
Carlo Anez Mazurco
Instructor · CTI, Detection & AI-Assisted Defense
Practitioner and educator focused on cyber threat intelligence, detection engineering, and responsible AI-assisted SOC workflows. Instructor of Blue vs. Red with AI at DEF CON Training Las Vegas 2026.
¿Listo para profundizar?
Solicita una entrega privada para tu equipo o explora nuestros recursos gratuitos para empezar hoy.