Script vs. Agent: Detecting Autonomous Adversaries by Their Re-planning Loops

Why volume and static signatures fail against AI attackers — and how to track goal-directed trajectory instead.

TL;DR — Static signatures and rate limits fail against AI adversaries that adjust pacing and payload syntax dynamically. Blue teams must transition to stateful trajectory tracking — evaluating multi-tactic MITRE ATT&CK progression — and re-planning loop observers that catch immediate, context-aware command pivots following execution failures.

This article summerize things I have found while working with CHN.

The Collapse of Volume and Syntax Signatures

Traditional SOC detection engineering relies on two assumptions: adversaries execute at machine speed (rate-limit triggers), and they rely on predictable tool signatures (static string matches).

Modern LLM-driven agents break both assumptions. Operating via autonomous feedback loops, an AI agent throttles its execution pace to mimic human operators, obfuscates command wrappers on the fly, and switches tooling seamlessly. A Sigma rule targeting certutil or whoami is useless when an LLM reads EDR telemetry feedback and pivots to raw API calls or native PowerShell cmdlets.

Speed measures velocity; syntax measures tool selection. Neither measures the adversary’s underlying reasoning or intent.

Mapping Goal-Directed Behavioral Trajectory

Detecting autonomous reasoning requires tracking behavioral trajectory — the ordered, goal-directed movement across distinct tactical phases within a defined session window.

While automated scripts hammer a single endpoint vulnerability endlessly (generating uniform path-traversal logs), an AI agent demonstrates structured, adaptive movement. A stateful detection engine maps real-time telemetry to core MITRE ATT&CK tactics:

• Discovery: Querying active network interfaces or environment configuration.
• Privilege Escalation: Inspecting local token privileges or security registers.
• Defense Evasion / Execution: Staging living-off-the-land binaries (LotLBs) tailored to local EDR constraints.

A high-confidence detection triggers when a single session crosses ≥3 distinct ATT&CK tactics inside a bounded time window, regardless of execution volume or inter-command delays.

Isolating the Re-planning Loop

The ultimate discriminator of an autonomous agent is how it responds to execution failure.

When a deterministic script encounters an unexpected error (0x5 Access Denied or HTTP 403), it either crashes, terminates, or blindly cycles through a static queue. An AI agent behaves differently: it feeds stderr/stdout back into its context window, reflects on the constraint, and generates a semantically modified command targeting the same operational goal.

Blue teams can isolate this context-aware reflection loop by monitoring stateful execution transitions:

1. Failure Signal: An action yields an error state (non-zero exit code, access denial, or HTTP block).
2. Semantic Pivot: Within N seconds, the session executes a new, syntactically distinct command targeting the exact same subsystem.
3. Constraint Adaptation: The follow-up execution explicitly addresses the error surfaced in step one (e.g., pivoting from RPC-based WMI calls to WinRM after encountering network blocking).

Catching an execution failure followed by an immediate, adaptive retry distinguishes reasoning agents from traditional automated scripts.

Engineering Guardrails for Blue Teams

To prevent alert fatigue from noisy internet scanners, apply three non-negotiable detection guardrails:

• Gate Alerts on Multi-Tactic Thresholds: Never trigger high-severity alerts on isolated retry loops within a single tactic (such as repeated password guessing). Require multi-tactic trajectory progression before elevating threat severity.
• Bind State to Authenticated Sessions: Track re-planning state strictly within cryptographically verified session contexts — never raw IP addresses — to eliminate false-positive campaign grouping across shared NAT gateways.
• Enforce Monotonic Scoring: Replace simple arithmetic averages with monotonic combination models (such as logit-dampened noisy-OR). Ensure that independent corroborating evidence strictly increases overall threat confidence rather than diluting it.