[{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/tags/ai/","section":"Tags","summary":"","title":"Ai","type":"tags"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/tags/attck/","section":"Tags","summary":"","title":"Att\u0026ck","type":"tags"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/","section":"Blade Scott","summary":"","title":"Blade Scott","type":"page"},{"content":"A local AI analyst agent. A local LLM (the brain) drives real forensic tools (the hands: Chainsaw, Sigma, ATT\u0026amp;CK lookup, authentication analysis) to triage Windows evidence and write a cited report.\nIt\u0026rsquo;s built so sensitive evidence never leaves local hardware. Rented cloud GPUs are only ever used with public sample data.\nWhy I built this # A lot of SaaS providers charge a boatload for DFIR agents, and most of them seem kind of bad. Talking to people across the DFIR industry, experience levels vary a lot. An open-source baseline for DFIR work, across a range of intelligence and threat types, sounds like something people would actually use, including me.\nI\u0026rsquo;d like it to make people better at doing their own work, and to save professionals time without them losing capability. The agent shouldn\u0026rsquo;t know more than the analyst using it. I\u0026rsquo;m big on an AI agent being a junior or an assistant, not a replacement.\nBuilding agents isn\u0026rsquo;t my forte, so I\u0026rsquo;ve used AI heavily to write the code. The DFIR side is mine: the test cases, what counts as a good report, and what the agent gets wrong.\nArchitecture # Brain (gpt-oss) Ollama (local GPU) or vLLM (A100) ▲ │ tool requests report │ ▼ SIFT VM (hands) triage.py + llm.py chainsaw_hunt, get_detections, attack_lookup, auth_summary, decode_powershell │ evidence share (read-only) Role What runs there Brain gpt-oss:20b on Ollama, or 20B/120B on vLLM Hands SIFT VM: agent, Chainsaw, Hayabusa, Volatility, plaso, EZ Tools Evidence Shared into the VM read-only The brain only ever sees filtered tool output, never raw evidence. Swapping brains is a settings change, not a code change. The model never learns. All improvement lives in files: the analyst guide, the tools, the test cases and the checker. Swapping models keeps all progress. Tools the model can call # Tool Does chainsaw_hunt() Chainsaw + Sigma over the case evidence. Priority rules first, each rule\u0026rsquo;s ATT\u0026amp;CK tags, activity time clusters. Cached, so parallel runs share one hunt get_detections() Example events for one rule; flags loopback sources attack_lookup() Searches MITRE ATT\u0026amp;CK; swaps revoked IDs for their replacements auth_summary() Kerberos, NTLM and failed logons by source; flags spraying, enumeration, brute force, success after failures decode_powershell() Decodes -enc / base64 / gzip blobs; labels download cradles, AMSI bypass, Defender tampering, shellcode loaders Two more summaries are attached automatically after every hunt: remote logons (type 3/10 by host, source and account, with source IPs named from Sysmon) and service installs (7045/4697 with installer, run-as account and binary path).\nDesign rule: enforce in code, not in the prompt # Small models drop prompt rules. Code doesn\u0026rsquo;t. Never make the model type what code already knows: paths, rule names, counts, timelines.\nGuardrails that live in code:\nATT\u0026amp;CK validator. Every cited ID must be active and backed by a lookup, the guide or a Sigma tag. Bounced once, then stripped to (ID unverified). Coverage check. If high-severity rules weren\u0026rsquo;t inspected, code pulls examples itself and hands them to the model to rewrite the report. No-tools recovery. If the model ends its first turn without calling a tool, code runs the hunt and carries on. Claim checks. Named claims (exfiltration, Mimikatz, C2) with no support in any tool output are flagged in an auto-generated section. ATT\u0026amp;CK names written by code, not the model. Testing # Four test cases built from public datasets, each run 10 times per change and graded by a checker:\nCase Evidence Lateral movement EVTX-ATTACK-SAMPLES, 47 unrelated files Credential dumping 5 curated EVTX files Multi-stage APT Hayabusa sample APT attack steps APT29 day 1 OTRF APT29 Evals, 4 hosts, 196k events Current scores, gpt-oss:20b on vLLM (average / fixed checks):\nCase Score Lateral movement 94 / 92 Credential dumping 96 / 97 Multi-stage APT 98 / 98 APT29 day 1 95 / 93 The first version of the agent scored 48% on lateral movement.\nLessons so far # Tools and guardrails beat model size. Most gains came from better tool output and code checks, not from moving 20B to 120B. Format beats data. The APT29 pivot IP was in the tool output every run, yet 7/10 reports dropped it. One line in the report format fixed it: 10/10. Test data can leak the answer. A folder named after the threat actor reached the model, and 7/10 reports named the actor with no evidence. Renaming the folder fixed it. Repeating the right answer doesn\u0026rsquo;t make the model use it. Putting the correct PsExec technique IDs in tool output 3–4 times didn\u0026rsquo;t change what it cited, and it crowded out other findings. One line in the report format did. One flat list can invent a campaign. A single host table made the model treat unrelated sample hosts as one coordinated attack. Grouping by domain fixed it. A low average can be one broken run. One score of 83 turned out to be a single run where the model called no tools and wrote a refusal. The other nine were fine. Always check the outliers before changing anything. Question the checker as hard as the agent. 5 runs swing ±5 points; 10 runs are the minimum for a keep/revert call. ","date":"28 October 2026","externalUrl":null,"permalink":"/posts/dfir-agent/","section":"Write-ups","summary":"A local LLM driving real forensic tools to triage Windows evidence and write a cited report.","title":"Building a Local AI DFIR Triage Agent","type":"posts"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/tags/chainsaw/","section":"Tags","summary":"","title":"Chainsaw","type":"tags"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/tags/dfir/","section":"Tags","summary":"","title":"Dfir","type":"tags"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/series/dfir-agent/","section":"Series","summary":"","title":"DFIR Agent","type":"series"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/tags/evtx/","section":"Tags","summary":"","title":"Evtx","type":"tags"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/tags/llm/","section":"Tags","summary":"","title":"Llm","type":"tags"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/categories/projects/","section":"Categories","summary":"","title":"Projects","type":"categories"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/series/","section":"Series","summary":"","title":"Series","type":"series"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/tags/sigma/","section":"Tags","summary":"","title":"Sigma","type":"tags"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/tags/windows/","section":"Tags","summary":"","title":"Windows","type":"tags"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/posts/","section":"Write-ups","summary":"","title":"Write-ups","type":"posts"},{"content":"I\u0026rsquo;m Blade, a DFIR practitioner based in Melbourne.\nI lead a SOC and act as its escalation point for serious incidents: containment, forensics, root cause and the report at the end. Most of my work is host-based forensics on Windows, timeline reconstruction, and threat hunting across SIEM, EDR and NDR data.\nI got here the long way: corporate IT support, then security analyst, then senior analyst, where I wrote over 1,000 detection rules before moving into leading the team.\nWhat\u0026rsquo;s on this site # Write-ups from labs, CTFs and retired challenges, plus progress on side projects like a local AI triage agent. Nothing here comes from my employer or any real investigation.\nCertifications # GIAC Certified Forensic Analyst (GCFA) SANS FOR508 Challenge Coin Opinions are my own.\n","externalUrl":null,"permalink":"/about/","section":"Blade Scott","summary":"","title":"About","type":"page"}]