Prep4Evil

Inspiration

Industries desperately need an answer to autonomous, agentic threats. In the current cybersecurity landscape, software components, malicious scripts, and advanced AI attacks can be easily created, replicated, or plagiarized at machine speed. Cybersecurity has fundamentally evolved into an adversarial game between Red and Blue teams where the dynamic is determined by speed and scale.

Active incident response analysts are drowning under mountains of disconnected log files, terminal outputs, and rapidly deployed, multi-host saturation. We realized that while autonomous AI agents are being introduced to accelerate defense, their outputs are traditionally an unreadable black box. The moment AI starts making forensic decisions at speed, true transparency and rigorous reproducibility stop being optional. We built this project to prove that you can pair the cognitive scale of LLMs with unyielding, non-negotiable forensic soundness.

What it does

Our solution is a deterministic agentic triage and orchestration engine built on top of the SIFT Workstation. It handles the entire digital footprint investigation lifecycle for disk and memory images by converting chaotic artifacts into a defensible, reproducible, cross-host narrative.Multi-Step Within-Host Correlation: It chains Plaso (temporal timelines), Volatility (runtime memory tampering), and EZ Tools/Redline (persistence mechanisms) to reveal a hidden "Temp-to-Stealth" lifecycle (Temp Loader $\rightarrow$ Masqueraded svchost $\rightarrow$ Registry/Service Persistence $\rightarrow$ Hook-based Stealth) that is entirely invisible to individual tools in isolation.Across-Host Campaign Hunting: It shifts the paradigm from simple "incident triage" to holistic "threat hunting" by automatically identifying Campaign Repetition—detecting identical masquerade paths and overlapping time windows across completely distinct machines (e.g., nromanoff and tdungan).Defensible Hand-offs: It maps out an honest IR lifecycle by completely owning the Preparation and Detection & Analysis phases [cite: ]. Instead of faking live-host actions, it generates a prioritized, evidence-cited target list of what to isolate, terminate, or remove, passing clean, mathematically verified inputs downstream to containment and eradication teams .

How we built it

We engineered a five-layer decoupled orchestration architecture that integrates advanced LLMs (like Claude and Gemini) with deterministic forensic guardrails:The Moat (Preparation-as-a-Product): We pre-staged skills, runbooks ($C1$–$C6$), and our custom sift_evidence.py engine running 30 specialized matchers (such as NUL-tolerant l2tcsv and SQLite read-only .mans parsers) [cite: ].Policy-as-Code Governance: To ensure absolute forensic integrity, raw evidence directories (00-TRIAGE/raw/) are marked strictly read-only. Hard security deny-lists block exfiltration or destructive commands, while automated Stop hooks write to a forensic_audit.log after every single action.Zero-Context Functional Triage: We stripped conversation history out of the core triage step. Every action is a pure function of (verified evidence bytes + CLI args). State snapshots are completely serialized to disk, allowing any worker node to cold-start instantly.The Interface Layer: We linked the underlying orchestration to a clean, visual web layout that displays the exact execution logs, confidence levels (Lead, Probable, High), rules in effect, and the clear lineage separating retrieved background knowledge from agent-verified findings.

Challenges we ran into

Decoupling Trust from Retrieval (RAG vs. Agentic Reasoning): Standard RAG setups treat retrieved data as truth. We struggled with the reality that historical indicators of compromise (IOCs) are just educated guesses from unverified history. We had to implement a strict logic boundary: retrieval only proposes hypotheses. The agent is forced to re-derive and verify those IOCs directly from raw, verified evidence bytes before acting on them.

Engineering True State Resumability: LLM agent sessions frequently drop, error out, or run into context bloat during massive log reviews. Overcoming this required building state serialization into the file layer rather than system memory, ensuring that if an agent dies at hour 12 of a 24-hour job, a supervisor node can instantly spawn a clean agent to read the plan files, identify the last completed gate, and idempotently re-run the single in-flight step with minimal progress loss.

Accomplishments that we're proud of

We are incredibly proud of building an AI-driven security tool that completely rejects hallucinations and forces the language model to prove its claims. We established a golden, falsifiable MVP success metric that a judge or a lead analyst can verify in under five minutes:

347 — This is nromanoff's total API-hook count.

The language model never "knows" this number inherently; our underlying orchestration engine re-derived it autonomously from the verified memory image to exactly match the documented baseline. It is fully reproducible with a single script execution: python3 /home/sansforensics/Documents/SIFTVault/01-SKILLS/memory/scripts/mem_05_apihook_aggregate_crosshost.py

What we learned

We learned that the real value in an AI-accelerated world doesn't lie in building generic prompt wrappers; it lies in establishing verifiable touchpoints and layered architectures. We realized that while strong ground truth and hierarchical reasoning allow us to encapsulate superhuman-speed threat capabilities, the system must remain completely transparent. Security controls, audit logs, and read-only constraints mean nothing to an incident responder if they aren't visible; building the bridge between what the agent executes and what the analyst visualizes is what creates operational trust.

What's next for Prep4Evil

Expanding the Placement Map & Automating the Defensibility Moat: We plan to integrate deeper coverage across changing operating system kernel versions, broadening our automated baseline validation (WinXPSP3x86.txt and beyond).

Bi-Directional Knowledge Ingestion: Ensuring today's proof seamlessly becomes tomorrow's prior. We want to expand the automated "Codify" phase, allowing verified findings to write directly back into the long-term intelligence vault, continuously hardening our defenses against evolving, machine-delivered payloads.