Repository navigation
Home
Hands-on kit for Black Hat USA 2026 Arsenal Lab, session #53649.
Two self-contained cloud/network investigation scenarios driven by an AI agent loaded with open-source security skills. All data is synthetic. No live system is touched.
Black Hat and Black Hat Arsenal are trademarks of Informa Tech Holdings LLC. This project is not affiliated with, sponsored by, or endorsed by Black Hat or Informa. This is an independent community project, not affiliated with, sponsored by, or endorsed by Anthropic, PBC. "Anthropic" and "Claude" are trademarks of Anthropic, PBC.
One fictional universe — Acme Rentals — seen from two ends.
| Scenario | Shape | The question | |
|---|---|---|---|
| S1 | Scenario 1 TollBooth | reactive DFIR | A breach already happened. What did they take, and how? |
| S2 | Scenario 2 OpenDoor | proactive audit | Before that breach — which holes were open? |
OpenDoor is the audit that would have prevented TollBooth. Running both shows the same three misconfigurations from the attacker's side and the defender's side.
≤5 min slides + ≤5 min instructor demo + ~20 min hands-on
The crowd rotates, so most attendees see one block. Run one scenario per block and alternate across the day, or let each participant choose. S1 is the stronger marquee demo; S2 is lighter (pure jq over JSON) and a good fallback if model access or pcap tooling misbehaves.
Drives the agent; the agent runs the tools. Every step also has a raw tshark / jq command, so anyone without a working agent still finishes the lab. That fallback is not a consolation prize — it is what makes the comparison honest. You can see exactly what the agent saved you.
| Build the laptops the day before | Setup |
| Run scenario 1 | Scenario 1 TollBooth |
| Run scenario 2 | Scenario 2 OpenDoor |
| What is in the kit | Datasets |
| The million-event tier | Advanced Tier |
| Running it on the floor | Instructor Runbook |
| Key handling, spend caps, safety | Security and Safety |
| Which skills each phase uses | Skills Used |
| Something broke | Troubleshooting |
https://github.com/mukul975/BHUSA-Anthropic-CyberSecurity-Skills
The skills the agent loads come from Anthropic-Cybersecurity-Skills — 817 skills mapped to six frameworks, Apache-2.0.
Everything in this kit is synthetic and self-contained: a fictional company, RFC 5737 documentation IP ranges, and AWS EXAMPLE-format keys. The techniques you practise here are for systems you own or have written permission to assess. Nothing else.
Apache-2.0 · All lab data is synthetic. For systems you own or are authorized to assess. · Black Hat and Black Hat Arsenal are trademarks of Informa Tech Holdings LLC; this project is not affiliated with or endorsed by Black Hat or Informa. · Not affiliated with Anthropic, PBC. · MITRE ATT&CK®, D3FEND™ and MITRE F3 are trademarks of The MITRE Corporation.
Run the lab
Reference
Presenter
Black Hat USA 2026 Arsenal · #53649