AI-Accelerated Offensive Ops vs. Manual DFIR Speed Gap

▶ Watch (02:34)

Two days before this talk, Anthropic published a report on Claude Code used for offensive operations. Chinese threat actors had paired it with operational tooling and let it run. The finding: attack tasks that took days or weeks now take seconds or minutes. Meanwhile, the audience polled 2–3 days, sometimes a week, to produce a single forensic report on one compromised system.

“What if I said you could do a full day of manual forensics to report in 14 minutes?” — Rob T. Lee

Manual DFIR speed cannot match AI-accelerated offense. The only answer is AI on defense, running at the same pace.

CLAUDE.md as Forensics Orchestration Layer

▶ Watch (08:59)

The CLAUDE.md file is the prime directive. It sets deterministic boundaries: hardcoded tool paths, explicit rules about which capabilities to run and which to skip, and an instruction to stop asking questions mid-case and just execute. Beneath it, per-tool skills.md files tell Claude Code what each SIFT tool does, what flags it accepts, and how to interpret its output. Lee built those files by pointing Claude Code at the man pages, running the commands, and pulling the flags directly. An hour and a half of that bootstrapping work is what made the 14-minute forensic run possible.

Live Demo: Memory and Disk Image Analysis in Under 20 Minutes

▶ Watch (11:23)

Two prompts drove the entire demo. The first triggered Memory image analysis — 18-minute full report: Claude Code ran Volatility-family tools autonomously, then produced a report covering WMI execution, malicious binaries, code injection, C2 connections, and remediation steps. The second was two words. Lee typed

“find evil” — Rob T. Lee

and watched Claude work through prefetch, AMCache, event logs, and timeline analysis to deliver the C drive ‘find evil’ — 14:27 full forensic report, MITRE ATT&CK-mapped, in PDF. He had compromised the system himself. The report missed nothing.

Context Rot: The Limiting Factor for Enterprise Scale

▶ Watch (15:01)

There is a catch. Context rot degrades performance as a session runs longer. Repeat the same analysis against the same intrusion set, and Claude Code gets progressively worse. That ceiling makes single-system forensics tractable but enterprise-wide incident response — dozens of hosts, one continuous session — a harder problem.

“We need to increase the speed of our incident response capabilities to match the speed of the offensive teams leveraging the same capabilities.” — Rob T. Lee

SANS SIFT Hackathon: Community as Defensive Force Multiplier

▶ Watch (15:51)

The proof of concept works. The question is whether defenders build it out before offensive teams do. SANS is running a funded hackathon, April 1 through May 15, with a $22,000 prize pool. Track one targets forensic MCP engineering: take the existing SIFT integration and push it 10 to 100x. Track two targets context rot directly. Anthropic is in talks to supply tokens so participants don’t pay out of pocket.

“What the offensive teams don’t have is a thousand of us.” — Rob T. Lee

The goal: a deployable AI incident response capability by June 1. Resources, disk images, and memory images go up at protocol-sift.ai.

Q&A

How did you handle context rot — did you lazy-load skills via an orchestrator agent or tell Claude Code to figure it out? He used Claude Code itself as the orchestrator: told it to read every SIFT tool’s man page, run anything without a man page directly to get its flags, and look up docs online — but admitted he spent 90 minutes fighting context issues and has no clean solution, which is the reason for the hackathon. ▶ 20:41

For single-system forensics, is starting a new session enough to handle context rot, and did you find a better approach for enterprise scale? New sessions work fine for single-system forensics, but no better approach exists yet — enterprise-scale use across a thousand systems would exhaust context fast, and a production-grade solution would need persistent state and threat-intel feeds that the current proof of concept does not have. ▶ 21:48

Is Claude Code actually running the tools locally or cheating by looking up answers online? He assumes it runs tools locally — the system logs every command and output file it uses to build the report — but he acknowledged he has not explicitly blocked internet access, so whether it infers anything from online sources is an open question. ▶ 22:59

Notable Quotes

What if I said you could do a full day of manual forensics to report in 14 minutes? Rob T. Lee · ▶ 4:57

find evil Rob T. Lee · ▶ 12:36

We need to increase the speed of our incident response capabilities to match the speed of the offensive teams leveraging the same capabilities. Rob T. Lee · ▶ 15:37

What the offensive teams don’t have is a thousand of us. Rob T. Lee · ▶ 18:03

Key Takeaways

  • Pair Claude Code with a CLAUDE.md orchestration file and per-tool skills.md files to give AI deterministic control over your full DFIR toolchain.
  • Context rot — not accuracy — is the binding constraint; solve it before scaling AI-assisted forensics to enterprise-wide incident response.
  • Open-source community scale is the defender’s asymmetric advantage; contribute to AI DFIR tooling before adversaries finish building theirs.