-
-
# SENTINEL + GHOST HUNTER — Autonomous IR & APT Attribution Agent
Inspiration
Modern cyberattacks move faster than human responders. While analysts spend hours manually correlating forensic evidence, attackers can establish persistence, move laterally, and exfiltrate data within minutes.
SENTINEL v2.0 was built to change that.
Instead of acting as another AI chatbot, SENTINEL operates as an Autonomous Digital Forensic Investigation Operating System that investigates compromised systems, validates evidence, challenges its own conclusions, and produces executive-ready forensic reports with explainable reasoning.
Beyond identifying the attack, GHOST HUNTER extends the investigation by answering one of the hardest DFIR questions:
Who is most likely behind this attack?
What it does
SENTINEL autonomously performs an end-to-end digital forensic investigation from a single command.
Given a compromised memory image, it:
Acquires and validates forensic evidence Detects malware, persistence, and injected code Extracts Indicators of Compromise (IOCs) Maps attacker behavior to MITRE ATT&CK Reconstructs the complete attack timeline Challenges every finding using an adversarial AI reviewer Resolves conflicting conclusions through an evidence consensus engine Produces an executive-ready PDF investigation report
After the investigation is complete, GHOST HUNTER performs autonomous threat attribution by correlating malware behavior, infrastructure, and MITRE techniques against known nation-state APT groups.
Demonstrated on the SRL-2018 enterprise compromise
SENTINEL automatically identified:
Backdoor: PowerShell/Listrun.A Meterpreter payload execution DLL injection (mstd32.dll) Command & Control infrastructure (myvinhlong.com, smart-web.me) PowerShell execution policy bypass Anti-forensics activity Complete attack timeline MITRE ATT&CK mapping
GHOST HUNTER concluded:
🎯 APT32 (OceanLotus)
92% confidence
after comparing multiple threat actors including:
APT28 APT29 APT32 APT41 Lazarus Group
while explicitly rejecting alternative attribution hypotheses.
How I built it
SENTINEL was developed entirely on the SANS SIFT Workstation using Python and Groq LLMs.
Rather than relying on a single AI agent, the platform uses a multi-agent investigation architecture composed of specialized forensic agents.
Investigation Pipeline
Evidence Acquisition
↓
Memory Analysis
↓
IOC Detection
↓
Attack Timeline Reconstruction
↓
MITRE ATT&CK Mapping
↓
Evidence Correlation
↓
Adversarial Review
↓
Consensus Engine
↓
Executive Report Generation
Multi-Agent Architecture SENTINEL — Memory Forensics Specialist GHOST HUNTER — Nation-State Attribution Analyst ORACLE — Predictive Threat Intelligence SKEPTIC — Hallucination & Contradiction Detection CONSENSUS — Evidence Correlation Engine REPORTER — Executive Report Generator
Every major conclusion must survive peer review before appearing in the final report.
Unlike conventional AI assistants, unsupported claims are challenged instead of accepted.
All security guardrails are enforced architecturally.
Destructive operations (rm, dd, shred, mkfs, etc.) are blocked at the execution layer rather than through prompting alone.
Challenges I ran into
Building a trustworthy autonomous investigator required solving more than LLM prompting.
Major challenges included:
Volatility 3 symbol compatibility Memory forensic tool integration Eliminating AI hallucinations Preventing unsupported APT attribution Correlating evidence across independent sources Building explainable confidence scoring Designing an adversarial review system capable of disagreeing with other AI agents Accomplishments that I'm proud of Successfully investigated a real compromised enterprise memory image Identified six high-confidence Indicators of Compromise Generated complete attack timelines automatically Produced MITRE ATT&CK mappings without analyst intervention Built a multi-agent evidence validation workflow Created an adversarial AI reviewer that challenges unsupported conclusions Implemented an evidence consensus engine for conflict resolution Produced executive-ready forensic reports automatically Added autonomous nation-state attribution with explainable confidence scores Designed architectural guardrails resistant to prompt injection What I learned
Autonomous DFIR is fundamentally an evidence problem, not an AI problem.
An investigator is only as trustworthy as its ability to explain every conclusion.
The biggest lesson from this project was that autonomous systems must be capable of saying:
"I don't have enough evidence."
Building mechanisms that detect uncertainty, challenge conclusions, and require supporting artifacts proved far more valuable than simply generating faster answers.
What's next for SENTINEL
The long-term vision is to evolve SENTINEL into a complete Autonomous Digital Forensic Investigation Operating System capable of investigating enterprise-scale incidents.
Planned capabilities include:
Full disk image correlation (E01 support) PCAP and network forensic analysis Windows Event Log correlation Registry timeline reconstruction Multi-host enterprise investigations Active Directory attack path reconstruction SIEM integration (Splunk, Elastic, Microsoft Sentinel) Real-time autonomous investigations Enterprise evidence graph visualization Expanded GHOST HUNTER database covering 20+ nation-state APT groups Retrieval-Augmented Threat Intelligence (RAG) Interactive investigation dashboard
Log in or sign up for Devpost to join the conversation.