SIFT – FIND EVIL!! I Gave Claude Code R00t on the DFIR SIFT Workstation

SIFT – Find Evil: Giving Claude Code Root on the DFIR SIFT Workstation

Speaker: Rob T. Lee, Chief AI Officer (CAIO) and Chief of Research, SANS Institute

Conference: [un]prompted 2026 — The AI Security Practitioner Conference

Date: March 3–4, 2026, San Francisco

Watch on YouTube: https://www.youtube.com/watch?v=OsUg3TlAqjQ

Reading time: ~10 minutes

TL;DR

Rob Lee, creator of the SIFT Workstation, gave Claude Code root access on a DFIR forensics environment and told it to "find evil." The result: a full forensic analysis that previously took human analysts two to three days compressed to 14 minutes and 27 seconds, with 100% accuracy on a system Lee had personally compromised. He used the talk to announce a SANS community hackathon with $22,000 in prizes aimed at turning a proof of concept into an enterprise-grade defensive capability.

Introduction

The SANS SIFT (SANS Investigative Forensics Toolkit) Workstation has been a foundational resource in digital forensics and incident response since Rob Lee started building it in 2008. Now 18 years old, SIFT aggregates hundreds of open-source forensic tools into a single, standardized environment used by analysts worldwide for disk imaging, memory analysis, event log correlation, timeline construction, and everything else that goes into reconstructing what happened on a compromised system.

Lee's experiment was conceptually simple: install Claude Code on the SIFT Workstation, give it root access, and see what it could do. What he found was not a marginal improvement in analyst efficiency — it was a category change. "What if I said you could do a full day of manual forensics to report in 14 minutes?" he asked the audience. "Okay, we'll come back to this." Then he showed them.

The timing was striking. Two days before Lee was scheduled to present his findings at a SANS event in November, Anthropic published a report on Claude Code being used to accelerate offensive operations — noting that Chinese actors had independently arrived at the same idea of combining Claude Code with operational tooling and "letting it go." Lee was running the same experiment on the defensive side. "Apparently the Chinese had the same idea I did," he said.

▶ Watch: Introduction — the SIFT experiment and timing context (00:00)

The Speed Problem in DFIR

Before showing the demo, Lee polled the audience: how long does a complete forensic analysis of a single system take — from first contact with the image to final report?

The answers: three days, two to three days, sometimes a week. Those numbers reflect reality for thorough, human-driven forensic work on a single endpoint. The process involves acquiring or receiving a disk image, running filesystem artifact analysis, analyzing event logs, building a timeline, performing memory analysis if available, correlating indicators across tools, and writing a report that a non-technical stakeholder can act on.

"What if I said you could do a full day of manual forensics to report in 14 minutes?" Lee continued. "It breaks the business model."

The business model comment was deliberate. SANS is a training organization. Lee acknowledged directly that this technology has implications for how forensic work is taught and done — but emphasized that the output of an AI forensic analysis is only interpretable by someone who understands digital forensics. "Only someone who knows digital forensics incident response can comprehend the report."

▶ Watch: The DFIR speed problem and the 14-minute claim (04:00)

How the System Was Built: The CLAUDE.md Orchestrator

The architecture behind Lee's SIFT + Claude Code integration centers on a CLAUDE.md file that he describes as "the prime directive, the orchestrator that's sitting behind the scenes."

Rather than giving Claude Code a blank-slate environment and hoping for the best, Lee built a structured context file that provides deterministic boundaries — hard-coded tool paths, explicit rules about which tools to run and which to avoid, and instructions for how to handle errors. The setup allows Claude Code to reason about the SIFT toolset without having to discover it from scratch each time.

The initial skill-building process took about 90 minutes:

1. Lee provided Claude Code with a full list of SIFT tools.
2. He instructed it to read the man pages for each tool. If no man page existed, run the tool directly to capture its command-line flags, and check online documentation if available.
3. Claude Code built its own skills.md files for each forensic task — subdirectory-level context files covering how each tool works, what its inputs and outputs look like, and what failure modes to expect.
4. Lee then had it red-team those skill files — validate the tool invocations, test for errors, and self-correct.

The result was a layered prompt architecture: a top-level CLAUDE.md that orchestrates the overall investigation, and subdirectory skills.md files that give Claude Code tool-specific knowledge without overwhelming the context window. This "lazy loading" of forensic knowledge — rather than dumping all documentation into a single context — was how Lee addressed the context rot problem for single-image analysis.

▶ Watch: Architecture — CLAUDE.md, skills.md, and context management (06:00)

The Demo: 14 Minutes, One Command

The live demo was structured around a realistic incident scenario: a threat group has compromised a network. Mail server and web server are forced offline. Perimeter defenses bypassed, key administrative accounts compromised, deep system persistence established. The analyst's job: scope the compromise, hunt for persistence, track lateral movement, assess exfiltration. The local defense status, per the scenario framing: overwhelmed.

The command Lee issued to Claude Code: find evil

After that, a second command: Write comprehensive report in PDF

"This is the only command that I gave it for writing that comprehensive report," Lee noted.

The system ran for 14 minutes and 27 seconds — on 16x playback in the demo. During that time, Claude Code executed across multiple disk images and memory images in the SIFT environment, running forensic tools automatically, correlating output, and building the final report. The report included:

• Executive summary
• Timeline of initial access through persistence
• Malware inventory
• Persistent mechanisms
• PowerShell transcript evidence
• Network indicators of compromise
• MITRE ATT&CK framework overlay
• Remediation recommendations and steps

Lee had personally compromised the system used in the demo, so he knew exactly what was there. His assessment: "This is 100% accurate for what it's finding." The report missed nothing. It also found F-Response (the forensic imaging tool used to acquire the image) as a false positive — a reasonable edge case, since F-Response does look like a remote access tool.

▶ Watch: Live demo — "find evil" and the 14-minute analysis (10:00)

Memory Analysis: 18 Minutes for a Full Report

The memory analysis demonstration used a separate scenario. Lee gave Claude Code a memory image with the instruction: "I'd like you to analyze this memory image and find anything malicious." No additional configuration beyond the CLAUDE.md context file and skills documentation.

The analysis took 18 minutes. The primary reason it didn't go faster: Lee had to press "Continue" repeatedly to extend Claude Code's action approval through each tool invocation. The report identified WMI-based initial execution, located a malicious process, documented its behavior, noted false positives, recommended remediation, and produced output reports — all in under 20 minutes.

Lee's framing: an hour and a half of skill-building, then point it at an image and let it run. "There's gotta be a catch." His honest assessment of the current limitations: context rot, self-correction when errors occur, and accuracy degradation over long repeated sessions.

▶ Watch: Memory forensics demo — 18-minute full analysis (06:00)

The Context Rot Problem

The primary technical limitation of the current system is context rot — the gradual degradation that occurs when a long-running LLM session consumes more and more of the available context window, causing the model to "forget" earlier findings.

For single-system forensics, the workaround is simple: start a new session. Claude Code will prompt you when context is full. For Lee's current proof of concept, this is adequate.

The problem emerges at enterprise scale. If you want to run parallel forensic analysis across a thousand systems looking for a specific indicator — say, prefetch evidence of a particular executable — the context accumulated across that investigation would exceed any single session boundary. The question of how to maintain investigation continuity across many systems, many tool invocations, and long time horizons is the unsolved problem.

The cross-system learning aspect does help within a session: "Once you go through a single image in a single case, it'll remember aspects of that initial intrusion, especially if you're hitting other systems. So if you find malicious code on one system, it's assuming it's looking for something contextually related on system two, system three, system four — so the speed naturally increases as you're working through the different exercise."

▶ Watch: Context rot, error handling, and enterprise scaling (10:00)

The SANS Hackathon: $22,000 in Prizes

Lee used the [un]prompted talk to make a major announcement: a SANS-sponsored hackathon running April 1 through May 15, 2026, with $22,000 in total prizes aimed at turning his proof of concept into a community-developed, enterprise-grade defensive tool.

The hackathon has two tracks:

Track 1 — Forensic MCP Engineering ($10,000 first prize, $7,500 second prize): Take Lee's proof of concept and build Model Context Protocol (MCP) servers that give Claude Code native, structured knowledge of SIFT forensic tools — their parameters, outputs, and failure modes. The goal is to accelerate the current system by 10–100x.

Track 2 — Cure the Context Rot ($4,500 in prizes): Develop solutions to the context rot problem — mechanisms that allow Claude Code to maintain investigation state across long sessions, multiple systems, or enterprise-scale deployments without losing earlier findings.

Lee noted he had reached out to Anthropic about providing token credits so participants don't have to absorb API costs during development. The hackathon website was being built at protocolsift.ai (registered the day before the talk).

The open-source angle is central to Lee's vision. SIFT is free. All the tools are free. The skills, CLAUDE.md files, and resources Lee built were being distributed to attendees at the end of the conference. "What the offensive teams don't have is a thousand of us," Lee said. "And if we bring the army of cyber defenders together and say, 'Let's start working on this as a whole' — the community advantage is real."

▶ Watch: Hackathon announcement — tracks and prizes (18:01)

Q&A Highlights

On context rot and lazy loading: Lee's approach to managing context was to use Claude Code itself as the orchestrator for skill-building — have it read man pages and tool documentation iteratively rather than front-loading everything. He explicitly loaded context only for the task at hand.

On accuracy and SANS training: When asked whether Claude Code might be "cheating" by having seen SANS course materials in its training data, Lee acknowledged this is a real question for training contexts — and for real investigations, where the system needs to stand on its own analysis, not on prior exposure to sample cases.

On enterprise scale: Lee was direct that the current proof of concept is not enterprise-ready. Single-system forensics works well. Scaling to parallel analysis across a thousand systems with maintained state is the open research problem that Track 2 of the hackathon is meant to address.

▶ Watch: Q&A — context management, accuracy, enterprise scaling (20:02)

Notable Quotes

"What if I said you could do a full day of manual forensics to report in 14 minutes? It breaks the business model."

— Rob T. Lee, 04:00

"Apparently the Chinese had the same idea I did — combining Claude Code with a bunch of operational tools and letting it go."

— Rob T. Lee, 02:00

"Only someone who knows digital forensics incident response can comprehend the report. I don't want to say this is the end of human existence when it comes to digital forensics."

— Rob T. Lee, 04:00

"What the offensive teams don't have is a thousand of us."

— Rob T. Lee, 16:01

Key Takeaways

• Claude Code on SIFT can compress days of forensic work to under 15 minutes. The 14-minute, 27-second full disk image analysis — producing an executive summary, attack timeline, malware inventory, MITRE ATT&CK overlay, and remediation recommendations — represents a genuine step change in DFIR efficiency.
• The CLAUDE.md architecture is the key. Structured orchestration context, deterministic tool paths, and subdirectory skills.md files give the agent reliable knowledge of the forensic toolkit without flooding the context window.
• Context rot is the primary limitation. Single-system analysis works well. Enterprise-scale parallel investigation across hundreds or thousands of systems requires solutions that don't yet exist — which is exactly what the hackathon is designed to produce.
• The open-source community has an advantage adversaries don't. Threat actors operate in small, secretive teams. The defensive community can mobilize thousands of practitioners simultaneously. Community-developed tooling can outpace adversarial use.
• Human expertise remains essential. The AI-generated forensic report is only intelligible — and only auditable — to someone with actual DFIR knowledge. The tool amplifies expert analysts; it doesn't replace them.

Slides and Resources Reference

Slides are available from the conference: 2026-04-04-D1-S2-11-12-SIFT-FIND-EVIL-I-Gave-Claude-Code-R00t.pdf. A transcript PDF is also available: 2026-04-04-Day1-Stage2-SIFTFindEvil-Lee-txt.pdf. Lee posted all supporting resources — memory images, disk images, CLAUDE.md files, skills.md files, and a NotebookLM guide — in the conference Slack. The hackathon website was being built at protocolsift.ai. SANS distributed all materials to conference attendees for independent replication.