FIND EVIL! — Evidence-Linked DFIR Triage Agent

▶ Demo video: https://youtu.be/RX9A2ldlUcs · ▶ Repo: https://github.com/cjw0076/find-evil-dfir-agent

An autonomous DFIR triage agent that ingests Windows and Linux forensic artifacts, reasons over them with a self-correcting analyzer pipeline, and produces an evidence-linked finding ledger — where every claim cites the exact artifact row that justifies it. Built for SANS' FIND EVIL! challenge.

What makes it prize-caliber

• Every finding cites its evidence. Click any reference chip in the console and the raw artifact row (Sysmon event, EVTX record, auth log line) opens inline. No unsourced conclusions — the core thing DFIR judges look for.
• 7 forensic analyzers, chained. super-timeline · process-tree reconstruction · persistence sweep · LOLBin scan · PowerShell decode · IOC extraction · lateral-movement graph. They feed each other, and the agent revises earlier conclusions when a later analyzer contradicts them.
• 5 full attack cases across platforms. phishing-macro → LSASS dump → SMB pivot · ransomware (shadow-copy deletion → mass encryption → C2) · living-off-the-land · Linux web-shell intrusion · insider USB exfiltration — each with a manifest and a ground-truth file to score against.
• Live triage dashboard. Pick a case, run the agent, and watch the MITRE ATT&CK techniques, timeline, IOCs, and the evidence-linked narrative render in real time (shown in the video).
• 78 passing tests plus an eval harness (eval/run_eval.py) that scores the agent's findings against ground truth.

How it runs

forensic artifacts (synthetic, ground-truthed)
  → 7 analyzers reason over the evidence
  → detections mapped to MITRE ATT&CK
  → self-correction when analyzers disagree
  → evidence-linked finding ledger (every claim → artifact row)
  → triage narrative + IOC list + attack timeline

Backed by a LiveTriageSource interface so the same agent can point at real collected evidence, not just the bundled cases.

MIT-licensed and fully reproducible offline.

Built With

• agents
• dfir
• mitre-attack
• python
• security