Full transcript
0:00AI, Chat, GPT, Claude, MCP, and other AI
0:06acronyms and buzzwords. It's no secret
0:09artificial intelligence is the new
0:10hotness, and a lot of people have
0:12different opinions, right? Good, bad,
0:14ugly, I don't know. But I think it is a
0:16really interesting conversation when we
0:18talk about it in the lens of cyber
0:20security. Could there ever be an AI
0:23powered hacker or threat actor? Or could
0:26we have AI hack you or me? So, I
0:29thought, you know what? Maybe a cool
0:30video would be chatting a little bit
0:32about and getting a chance to showcase
0:34the atomic red team MCP when Claude
0:38becomes the AP or the advanced
0:40persistent threat. Now, as always,
0:42kudos. Credit where credit is due. Big
0:45thanks to Cyberbuff. This is his tool
0:47and blog post. He has been breaking
0:50things with an atomic red team MCP
0:52server because manual exploitation is so
0:55last decade. And he says this new tool
0:58that he's put together has transformed
1:00his adversary emulation workflow
1:03significantly because he's been doing a
1:05heck of a lot of threat intelligence
1:07detection engineering and doing that
1:09manually by hand. As a human, it can be
1:11pretty slow and tedious and painstaking
1:14and manual when you're working through
1:16different reports trying to put this
1:18together into a YAML syntax to be able
1:20to execute it, test it, run it in your
1:21lab, and then see what's going on. And
1:24he was thinking, could we just have AI
1:26handle this, do it for us, or at least
1:29speed up a lot of this process? And
1:31that's a super cool thing because you
1:33could just say or declare, hey, show me
1:36how the Conti ransomware playbook has
1:38been working out. Run tests to extract
1:40credentials from Chrome or execute code
1:43like literally perform the task for
1:46persistence in whatever way. and he has
1:48accomplished this with an MCP server or
1:51a model context protocol that allows AI
1:54assistants like Claude to directly
1:56interact with external tools and
1:58databases instead of just copying and
2:00pasting in and out of chat GPT or
2:03whatever. Before hooking this up,
2:04creating the system, you might manually
2:06search for stuff in GitHub, copy things
2:08in and out, and then kind of do this all
2:10one by one. But with this MCP server
2:13built out, you could just have Claude
2:15like query the information and then
2:16execute and run if that's what you want
2:18to do. So this is an MCP server for the
2:21Atomic Red Team. And we've covered the
2:24Atomic Red Team plenty of times before
2:26in other videos, but if you're not
2:27familiar, it is a library of tests, like
2:30small little encapsulated code or
2:33commands to run that emulate what a
2:35hacker or threat actor or adversary
2:37might do in an attack. and they're all
2:40mapped to the MITER attack framework.
2:43And a super quick crash course just in
2:44case you aren't familiar, the MITER
2:46attack framework is like a common
2:48language for us, you and I, people, the
2:51whole industry, to talk about cyber
2:53security or what hackers are doing, all
2:56with a standard sort of vernacular, the
2:58right language and lingo to explain,
3:00express and describe what they do, their
3:03tactics, techniques, and procedures, or
3:06their style. Because that could be so
3:08many different things like how they do
3:10reconnaissance, how they gain initial
3:12access, how they execute code, set up
3:14persistence, escalate privileges, access
3:16credentials, move laterally throughout a
3:18network, collect information, enumerate,
3:21exfiltrate, talk to their command and
3:22control, do any of the stuff that needed
3:25a taxonomy where there is a sort of ID
3:28for each and every technique. The Atomic
3:30Red Team project bundles all these up so
3:33that you have atomic tests to emulate
3:36and check, can you detect this? Does it
3:38work? Would you see this activity inside
3:40of your environment? So, with all that
3:43background context out of the way,
3:45sorry. In this video, I want to try
3:48this. I want to play with this. I want
3:49to spin up the Atomic Red Team MCP
3:52server so that I could have Claude
3:54execute these commands, run these tests,
3:57run these hacker techniques, and in
3:59essence hack me. But here's the thing.
4:02You see how this bullet execute tests in
4:04a controlled environment is noted as
4:06optional and disabled by default. Well,
4:08obviously it's kind of weird. You're
4:11letting the AI run code on your computer
4:14that you may or may not know. And it's
4:16sometimes always a little bit of a black
4:18box. And I get a little bit of the
4:20heebie-jebies when we're talking about
4:22some of the AI stuff just doing what it
4:25does. And it is a black box, especially
4:28maybe in the MCP or model context
4:31protocol world when we're connecting it
4:33to a ton of different applications and
4:35maybe even oh letting it run code on
4:37your computer and file system. So, I
4:39thought this was topical. I think it's
4:41pretty cool. I wanted to let you know my
4:43friends over at Harmonic, Harmonic
4:45Security, always doing really cool stuff
4:47to protect your data in the modern
4:49world, in the modern era with AI,
4:51artificial intelligence, and they've
4:53just released this MCP gateway. It's a
4:56developer friendly and locally installed
4:58system so that you and security teams
5:00have complete control and visibility
5:03over what's going on in your agentic AI
5:06environment. So whatever AI systems
5:08you're connecting to and MCP servers
5:10you're working with, you can see what
5:12they're doing and make sure they're
5:14doing it securely because MCP servers
5:16are doing super cool stuff because they
5:18have so much connectivity to the
5:20applications you might already be using
5:22like GitHub, like notion, like Slack,
5:24like Jira, whatever. But you can't
5:26always see what it's doing. It's that
5:28black box again. And they might have
5:30some sensitive data. And if you want to
5:31get in the middle of that, that MCP
5:33gateway could help save the day. They've
5:35got a super cool video where you can see
5:36a lot of the stuff in action here and
5:38whether or not you're working with this
5:39stuff in claude itself or within cursor
5:42or whatever they've got the connectivity
5:44there. Some sweet example they were
5:46working with this and they see the
5:47security policy does stop and prevents
5:50exposing any sensitive data. Same thing
5:52happens in cursor or any other
5:53environment that you might be working in
5:55to connect to these MCP servers and then
5:58it'll even raise an alert for you. So
5:59you'll be able to go review, see what
6:01happened and go track that in your
6:02environment. I think it's pretty cool if
6:04you're using AI in your environment. If
6:06you're working with MCP servers, maybe
6:07it's something that's worth checking out
6:09to get security right. I hope you go
6:11take a look. Link in the video
6:12description. Big shout out, big thanks.
6:14Appreciate Harmonic and their support
6:16and their sweet new MCP gateway link
6:18below. All right, now let's get to the
6:21real fun stuff. Let's throw security out
6:23the window and try to use the MCP server
6:27for Atomic Red Team and can I get Claude
6:30to hack me, so to speak, in essence,
6:32right? We're going to run these tests to
6:34be able to execute all the different
6:37atomics or different parts and pieces of
6:39a hacker's attack chain. I am inside of
6:42a Windows 11 virtual machine, so I will
6:44be able to play with this in a little
6:46bit of a safer environment. And I do
6:48want to go ahead and get this thing
6:50downloaded. I'm actually going to work
6:51inside of a git directory. And then from
6:54the GitHub repository, I do want to go
6:56ahead and install this. But if we're
6:59going to be using our AI crutch, why not
7:01go ahead and clone this repository and
7:03then just ask Claude to set it up for
7:05us. Let me get clone here. Cool. And
7:08then I will open up cursor. So now I
7:11have this whole GitHub repository opened
7:13up as just a project folder within
7:15cursor. And I'm going to ask Claude, I'm
7:16going to be a little bit lazy. Could you
7:18just do it for me? Could you please set
7:20up this tool so that I can run this MCP
7:23server locally and within cursor? Let's
7:27see what it cooks up. Looks like it
7:29found the cursor specific installation
7:31guide and it will be able to cruise
7:33through that. It will require UV. UV
7:36being one of the package managers for
7:38Python. And I will need to go ahead and
7:41let this yolo and do anything that it
7:44wants to realistically. It knows that it
7:46does not have UV installed. So, let's
7:48see if we could actually have it
7:49download it. And it does again. Hm. What
7:52do you trust? Uh oh. PowerShell just
7:54ieex piped whatever it downloaded from
7:56the internet. Well, okay. I'm inside of
7:58a virtual machine. We can go take a look
8:00at the installation files. It really
8:02just explains, look, you've got to have
8:04UV installed. And if you want to set
8:05this thing up, you just create the
8:07mcp.json
8:09file in the settings for cursor. Now, it
8:12ends up making sure it can create that
8:14mcp.json JSON and pull this all in for
8:17cursor to run and execute with it. Yes,
8:19you're totally allowed to edit that
8:21file. Let's see what you do. Already
8:23creates it. But it keeps the environment
8:26variable actually set to false whether
8:28we will execute the commands here. We
8:31can go ahead and change that. But it has
8:33built out now a cursor setup. Markdown
8:36file with a little bit more of the
8:38information. Tried to make sure this is
8:39all like running the UV utility inside
8:41of our path. building out a quick
8:43reference markdown file. So, this is
8:45still neat. All right, thanks Claude. I
8:48appreciate you doing everything for me,
8:51but let's go take a look. We will need
8:53to restart cursor to have this loaded.
8:55And I want to go flip that switch and
8:57actually turn on execution. Can I get to
9:00the settings here? Cursor settings. And
9:04I think that will let me get to Let me
9:06hide this window. Ctrl AltB. I'm trying
9:08to get a little bit better on the
9:09hotkeys. The MCP connection here does
9:13have an issue, but I think we'll just go
9:15ahead and restart it. Once we go ahead
9:18and change this to be true and if I
9:21restart cursor, then we should be able
9:23to see this up in action. Let me close
9:25out cursor. Open it once again. Let me
9:27take a quick look at the cursor
9:29settings. Now it's loading the tools.
9:32Waiting for this to finish up. Good.
9:33Looks like it has the six tools enabled.
9:36server info, refresh atomics, query
9:39atomics, and then work even with the
9:42YAML structure or kind of the outline,
9:44the code and syntax to define and
9:47declare a lot of these atomic tests. So,
9:49with this up and running now, we could
9:51just kind of work with it. Let me create
9:53a new chat window and let's just ask
9:56please tell me some of the atomic
10:00red team tests that pertain to Windows
10:05persistence mechanisms. Let's see what
10:08it will do. Fingers crossed. Users
10:10asking about atomic red team tests. They
10:12could use the MCP server. It's running
10:14the query atomics utility and uh oh,
10:17it's actually ended up writing things to
10:19a couple files here, but I think it will
10:21be able to chunk it up and give us some
10:24insight. Okay, it's tracking down some
10:26of the techniques. I saw some T info and
10:28the MITER attack IDs there. Got some
10:31results for scheduled tasks services.
10:33Sweet. Ooh, even got some Wii event
10:36subscription stuff. Okay, this is cool.
10:38And it'll give me these details. I mean,
10:41this is at this point just kind of
10:43correlating the info, the data that it
10:44probably just spat onto the file system,
10:47right? But could we then use this to
10:50generate a new test? Could we use some
10:53of this information to validate the YAML
10:55structure? Or could we just execute
10:58these tests and have it do whatever we
11:00want on the endpoint? Can you please
11:02tell me which atomic red team tests
11:08will make a very visible change to the
11:12endpoint and computer? Tell me different
11:15things that I could do that would work
11:18well in a video demonstration.
11:23What do you got? Looks like we could
11:26execute some programs and they have
11:29things in the registry or schedule task,
11:31some prompt or excuse me, credential
11:34prompting, process creation, network
11:37activity, downloading things. Ooh. All
11:40right. So, we're letting Claude take the
11:43wheel here. We're letting it take the
11:45reins. It suggested, oh, you know what?
11:47Here's a sweet demo that you could do.
11:49PowerShell credential prompt shows some
11:51fishing. Setting a registry run key.
11:53creating a scheduled task, executing a
11:56task, like to have the calculator open.
11:58I want to use that playbook that it just
12:02decided here for me, and maybe like
12:04change the desktop background or
12:06something. Uh-oh, ransomware. He he
12:08haha. Right. You had a good plan with
12:11this suggestion. And let me paste in all
12:14of those. Could you please execute all
12:17of these atomic red team tests with an
12:22additional test to change the desktop
12:25wallpaper background and do not clean up
12:29like restoring and putting the file
12:31system or the computer back to the state
12:32it was before you ran the test. That's
12:34one of the cool convenient like harness
12:36things that the atomic red team project
12:38lets you do. You could try this, see if
12:40it would detect it with whatever you're
12:42using for a seam, edr detection
12:44engineering, blah blah blah, and then it
12:46will revert it back before you did the
12:48damage. But for us to hack and oh hack
12:51me, let cursor and let Claude and let
12:54the atomic red team MCP server do the
12:57real damage here, I don't want it to
12:59clean it up. I want to be able to see
13:00that silly new background and all the
13:03tasks that it's created or the
13:04calculator opening here and there. So,
13:06do not clean up any of the tests that
13:09you run. You may execute everything to
13:13have the most visual fireworks. Let's do
13:17it. I uh want to actually bring cursor
13:20down so we could see the desktop
13:23environment as this thing runs. Will it
13:26be able to really change our background?
13:30It says, "Good. I found a scheduled task
13:32test." It's getting the unique
13:35identifiers. It will try to hopefully
13:38execute these. We've been seeing the
13:40query atomics tool ran executed a lot.
13:43But now it could be doing anything else
13:46like okay getting a unique identifier.
13:48Oh, actually executing the atomic. So
13:51what's happening? It's doing it. Uh I'm
13:53hands off keyboard.
13:55That's so cool.
13:58Oh, okay. Sure. This is so silly.
14:01They're adding a run key. Oh, it's going
14:03to actually prompt for, hey, what do you
14:05want the value to be? It could have a
14:07default thing, but let's do calc. See,
14:10Windows system 32. Oh, you know what? We
14:12should do car map because uh calc might
14:14be weird. I like car map.exe
14:17for our example. That should be a run
14:19dialogue key. Oh, it ran the cleanup
14:22command automatically. It caught that.
14:23That's super slick. Okay, now it's just
14:25auto running these commands. It's not
14:27running the MCP server at this point.
14:30There's calculator firing. Okay, you
14:33cheated on that one, Claude. That's not
14:35fair. But you did run the atomic test,
14:38so you know what? I can't complain. Um I
14:40think you're cheating again. You should
14:42be calling the commands. No, no, no, no,
14:46no. You don't need to write a a script.
14:48Just run the atomic test. You know what?
14:50That's my fault. I did say that
14:54it could run whatever it wanted to. We
14:57could have jumped out of bounds for our
15:00MCP server and Atomic Red team. My bad.
15:04Okay. Okay. Okay. You're cheating.
15:07Thanks. This has gone too far. I
15:10appreciate that. But I need you to do
15:12this only by the Atomic Red Team tests,
15:14please. No. No. You should not execute
15:17any commands individually, but only use
15:21the atomic red team MCP utility. Find
15:26the atomic red team test to change the
15:30desktop wallpaper. Execute it and do not
15:34clean up. Maybe that's a fine MVP. You
15:37know what? Maybe we could just have this
15:38thing change our desktop wallpaper.
15:40Pretend to be ransomware. We did get the
15:43execution for oh prompting for
15:45credentials. So that's still something.
15:47And of course, I hope you get the idea
15:49at this point, right? We're querying.
15:51We're trying to track it down. We're
15:53finding the replace desktop wallpaper
15:55and it got the unique identifier. Will
15:58we do it? Fingers crossed. Can we get a
16:01new desktop? Okay. Yeah, it wants to use
16:05uh a default value, which is fine. Reply
16:07with default to keep the default. Do it.
16:10Yep, you can keep it at the same place.
16:13You can keep it at the same place. I
16:14wonder if we could uh tweak this a
16:15little bit so it will just use the
16:17defaults.
16:19It changed the wall. Hey, you put it
16:21back. YOU PUT IT BACK. This is fun. Do
16:23not run the core commands directly. This
16:25is less fun. Stop. You're escaping the
16:28bounds of this video, Claude. We saw the
16:31wallpaper change, so I don't think we
16:32need to go do that again. That did fire.
16:35So now, let me get super bold, right?
16:37Let's run cursor as admin so that our
16:41MCP server and the atomic red team test
16:44that we work through will be able to do
16:47whatever it wants. What are some good
16:50examples here? They had some real world
16:52scenarios in the blog post. Okay,
16:55they're showcasing like generating uh a
16:58potential YAML or test based off of a
17:01thread intel report that you've seen out
17:03in the wild. That's pretty sweet. It'll
17:05end up extracting TTPs and making all
17:08sense of this to see, oh, do these
17:10techniques already exist in the Atomic
17:12Red Team project and library, or will it
17:15actually create new tests and then
17:16validate the AML syntax and then just
17:19let it run? Normally that would take an
17:21hour perhaps, but they cruise through it
17:24real quick. Do some detection rule
17:26validation. They're using an example
17:28with oh the Cloudflare D tunnel. That's
17:31cool and cutesy, but let's just do a
17:36Windows service. Let's create a Windows
17:39service and do not perform cleanup so
17:44that I can go see and validate the test
17:46has been performed. Do it. user wants me
17:50to use the Atomic Red Team MCP server to
17:52track down a Windows service creation.
17:55And I don't even have to know the attack
17:58technique ID. Okay, they're finding a
18:00couple couple different potential tests,
18:02but it might have found uh oh yeah, a
18:04couple good different unique IDs that it
18:07could use. And let me see what it'll do.
18:09Oh, it'll download an atomic service.exe
18:12binary. Sure, let's do it. You could use
18:15the default type of service is fine.
18:17Yeah, I would really love to be able to
18:19just steamroll over these and maybe
18:20that's a fun little uh exercise for the
18:23reader if any of you would like to go
18:24chip away at this MCP server and see
18:27what more you might be able to tweak or
18:28tune or experiment with. I think the MCP
18:31server code is just going to keep
18:33running cleanup even if it uh we try to
18:36tell it, oh, don't do that. But the
18:38coolest thing is that look, this is
18:40still kind of in development. Like this
18:41is a pretty recent project as of just a
18:43couple weeks ago, released at the end of
18:45October. And Cyberbuff is doing even
18:48more. You might have noticed the very
18:49beginning of the blog post that I showed
18:51you was just number one. But he's taken
18:54this a little bit further and now there
18:55is a number two post. I'm taking a look
18:58at his substack here and just after oh
19:01Claude becomes the AP, now there is a
19:04Claude becomes C2 or command and
19:06control. This is cool. breaking
19:08everything everywhere all at once.
19:12So he sets up the MCP server on not just
19:16oa Windows box but also within Linux and
19:19in Mac and then maybe even being able to
19:22bring in other emulation utilities like
19:25Calera. Do a little bit more testing
19:27here. Then we're really falling down the
19:30rabbit hole on oh how much is uh AI
19:33going to end up taking over a lot of the
19:35work that we might do. I'm sure folks
19:37have already seen like some cool stuff
19:38to be able to Oh, yeah. have it
19:40automatically hunt for vulnerabilities,
19:42trying to exploit vulnerabilities, do
19:45the ethical hacking. That is just cool.
19:48Oh, and they do this across all those
19:50different platforms. They're using
19:52persistence as that one example. But
19:54really, really neat just to think up all
19:55the different ideas here. Look, I hope
19:58you thought this was cool. I think this
19:59is neat. I think it's sweet to be able
20:01to tie together, you know, projects that
20:03we're used to working with like atomic
20:05red team and then cook up a MCP or model
20:08context protocol so that yeah, we could
20:10give the reigns to AI and then just see
20:12what it does and then look if you've got
20:15oh of course yep that uh educational
20:17warning that uh responsibility
20:20authorization and all the things that
20:21you're making sure oh you're testing
20:22this in your own environments unless
20:24you've got permission to do it
20:25elsewhere. But still, for the folks that
20:27are doing a lot of this threat
20:29intelligence work, for the folks that
20:30are doing this detection engineering
20:32efforts, and you're working in and out
20:34of, oh, the emulation, oh, the testing,
20:37oh, working with these harnesses or
20:38trying Atomic Red Team for the stuff
20:40that you're up to, this has got to be
20:42cool. Let me know in the comments below.
20:44Is this a gamecher? Are you using AI?
20:47Are you still a little bit angry? Do you
20:48got your pitchfork out? Are you poo
20:49pooing on all this AI stuff? or are you
20:52seeing where it is uh giving you those
20:54superpowers in the right way? But that's
20:56it. That's the end of the video. I'm
20:58done rambling. Thanks so much for
20:59watching. Hope you enjoyed this video.
21:00Please do give Harmonic Security,
21:02today's sponsor, some love. Link below
21:03in the video description. And with that,
21:05I'll see you in the next