TLDR Tech / InfoSec
How Well Can Open-Weight Models Evade SIEM Detection?
Vulnetic claims its autonomous "Sable" agent successfully compromised an Active Directory domain while evading high-severity alerts in Wazuh by utilizing LLM-driven living-off-the-land tradecraft. The agent mapped the network using remote BloodHound enumeration, executed a DCSync attack via DRSUAPI, and deployed a memory-resident HTTPS beacon inside a wsmprovhost process via WinRM to bypass standard detections. By pacing its actions and recognizing a custom prompt-injection canary, the agent generated only six low-severity alerts during the four-hour intrusion, though defenders should note these results stem entirely from the vendor's internal lab testing.
Read the full story