-
-
Logo
-
-
Inspiration
n modern Incident Response, SOC analysts are overwhelmed by raw data, and standard "AI Agents" often fail to help because they are restricted to chatting with text or summarizing PDFs. We wanted to build something real—an AI agent that acts as a Senior Responder. We were inspired to build an autonomous system capable of physically interacting with a Linux forensic environment, safely executing commands, and mathematically correlating massive datasets (like a 19GB memory dump) to find hidden, kernel-level threats.
What it does
Aura is an autonomous AI forensic agent powered by a custom Triangulation Engine. It safely bridges a local host to a secure SIFT Linux Workstation. Instead of relying on a single tool's output, Aura performs automated memory forensics by cross-referencing the operating system's active process list against a deep physical scrape of the RAM. By doing so, it can autonomously identify Direct Kernel Object Manipulation (DKOM) attacks and fileless malware.
How we built it
e engineered a custom Model Context Protocol (MCP) server in Python to act as the API middleware. This server wraps Volatility 3 commands (windows.pslist, windows.psscan, windows.malfind) into strict, JSON-returning tools.
We then deployed our AI agent over an SSH tunnel into the SIFT VM. This architecture creates a strict security boundary: the AI has zero direct write-access to the evidence mount, but can autonomously call the MCP tools to analyze a 19GB memory capture and parse the resulting data structures.
Challenges we ran into
Our biggest challenge led to our most significant breakthrough. During testing, we tasked the AI to find injected code in two highly suspicious hidden processes (svchost.exe and dllhost.exe). However, standard Volatility plugins like malfind reported them as "clean."Instead of failing, our agent successfully identified an architectural blind spot in the industry-standard tools. The rootkit had actively unlinked those processes from the Windows doubly-linked EPROCESS list. Because malfind relies on the OS process tree to scan memory, the payload was invisible to it.We solved this by explicitly engineering our Triangulation Engine to rely on set difference rather than simple API calls.Using standard set theory, where $P_{os}$ is the set of processes linked by the operating system and $P_{phys}$ is the set of processes carved from physical memory, the agent calculates the set of hidden rootkit processes ($R$):$$R = P_{phys} \setminus P_{os}$$Where $R \neq \emptyset$ definitively indicates a DKOM evasion tactic. Our engine successfully caught what standard automated sweeps missed.
Accomplishments that we're proud of
Outsmarting the Rootkit: We are incredibly proud that our Triangulation Engine successfully detected a Direct Kernel Object Manipulation (DKOM) attack that actively evaded industry-standard tools like Volatility's malfind. Proving that our architecture can catch what standard sweeps miss was a massive win.
Enterprise-Scale AI: Most AI agents break down or hallucinate when fed massive logs. We successfully engineered an MCP bridge stable enough to allow an LLM to autonomously orchestrate the analysis of a colossal 19GB raw memory dump without timing out.
True Agentic Autonomy: We didn't just build a chatbot; we built a Senior Responder. We are proud of engineering a secure architecture where the AI can formulate hypotheses and execute live Linux terminal commands inside a sandboxed forensic environment without risking evidence spoliation.
Mathematical Correlation over API Wrappers: Instead of just summarizing text outputs, we taught the agent to use set difference logic to find discrepancies between operating system structures and physical memory space.
What we learned
We learned that building effective AI for cybersecurity isn't about giving an LLM more data; it is about giving it the right architectural guardrails. We discovered how memory smearing affects large RAM captures, how to debug live API parsing errors across an SSH bridge, and fundamentally, how to teach an AI to understand kernel-level data structures rather than just reading text.
What's next for Aura: Autonomous Rootkit Forensics
Currently, Aura flags the unlinked memory segments. The next phase is to build an MCP tool utilizing YARA to physically carve the VAD tree offsets from the memory dump, allowing Aura to automatically extract the raw malware executable (.exe) directly to a secure quarantine folder for reverse engineering.
Log in or sign up for Devpost to join the conversation.