Important
1st Place: $10,000 Cash + SANS Summit Passes, Hotel/Travel Accommodations, & SANS OnDemand Courses for every team member! Let's build the ultimate digital forensics hunter! 🛡️🚀
🔗 Live: https://findevil.forenly.ai · 💬 Discord: https://discord.gg/qzs8PraeXS · Dashboard source: dashboard/
Forenly's entry for the Protocol SIFT hackathon (SANS / teamdfir) — AI-assisted DFIR. Theme: FIND EVIL!
A robotic / cyber-physical extension of the official Protocol SIFT POC. We add the one domain the base POC and reference tools (Windows/enterprise) don't cover: digital forensics for compromised autonomous robotic lawn-mower fleets. When a field mower speeds through a lidar zone, crosses its property line, or goes dark, Claude Code on the SANS SIFT Workstation runs real forensic tools — Volatility 3 (Linux), Sleuth Kit, Plaso, YARA — guided by our robot skill files, and writes a safety-cited Robot Incident Report (RIR).
The official teamdfir/protocol-sift POC is a
Claude Code configuration framework: skills/*/SKILL.md files + a case template + a
global routing prompt + forensic-CLI permissions. Claude Code is the agent; it consults the
skills and runs real tools on real evidence.
We follow that exact pattern and contribute the robot/cyber-physical layer:
| Contribution | File | Fills the gap |
|---|---|---|
| ROS 2 robot memory forensics | skills/ros2-robot-memory/ |
Base memory skill is Windows-only; this is Linux Vol3 + rogue /cmd_vel node detection |
| SLAM / boundary-map tampering | skills/slam-boundary-forensics/ |
Robot geofence/SLAM DB tamper (off-property escape) — no equivalent exists |
| Robot/IoT malware hunting | skills/robot-malware-hunting/ |
ARM Mirai on the LTE module + control-loop starvation, with robot YARA rules |
| Mower incident case template | case-templates/robotic-mower-incident/ |
Evidence layout, RIR structure, MITRE ATT&CK + ATT&CK for ICS mapping |
| Robot routing overlay | global/CLAUDE.md |
Routes robot symptoms to the right skill; cyber-physical constraints |
| Stage | Project | Role |
|---|---|---|
| Deploy | gcp |
Pick the right mower for a yard, plan the install |
| Operate | gemini-xprize — FleetMind |
Run day-to-day fleet ops |
| Respond | protocol-sift-dfir (this repo) |
Forensics when a fleet mower is compromised |
Reference platform across all three: Segway Navimow X3-class ROS 2 mower.
# 1. Get SIFT: download the OVA, or on Ubuntu 22.04: sudo cast install teamdfir/sift
# 2. Install the official Protocol SIFT POC:
curl -fsSL https://raw.githubusercontent.com/teamdfir/protocol-sift/main/install.sh | bash
# 3. Install this robot overlay on top:
git clone https://github.com/Forenly/protocol-sift-dfir.git
cd protocol-sift-dfir && ./install-robot-skills.sh# Stage evidence read-only + the matching Linux kernel ISF (see ros2-robot-memory → Symbols)
mkdir -p /cases/mower-001/{analysis,exports,reports}
cp ~/.claude/case-templates/robotic-mower-incident/CLAUDE.md /cases/mower-001/CLAUDE.md
# ...edit the evidence table...
cd /cases/mower-001 && claude
# e.g. "The mower at site 12 crossed its boundary into a pond. Investigate."Claude classifies the symptom → routes to the lead skill → runs real Volatility/TSK/Plaso/YARA
→ corroborates across memory/disk/timeline → writes ./reports/RIR_mower-001.md with the
forensic timeline, per-tool evidence, MITRE mapping, and safety-compliance citations.
examples/worked-case-mower-001/ is a complete
investigation run against a real ext4 evidence image — fls → icat → sqlite3 →
yara → mactime, all genuine tool output, ending in a print-ready PDF
Robot Incident Report. Two
scripts reproduce it from scratch (build_evidence.sh, run_analysis.sh). It demonstrates
the boundary-tamper case: keep-out geofence wiped in rtabmap.db (keep-out points 15 → 0)
→ mower off-property.
| Symptom | Lead skill | What it finds |
|---|---|---|
| Sped up / collided | ros2-robot-memory |
Rogue /cmd_vel node overrides speed limit, unsubscribes lidar /scan |
| Left the property | slam-boundary-forensics |
Keep-out geofence wiped in rtabmap.db → off-property escape |
| Went dark / blades wouldn't stop | robot-malware-hunting |
ARM Mirai on the LTE module starves the mowing controller |
Per SANS, Protocol SIFT is research-stage and not validated for forensic soundness or court admissibility. This overlay inherits that status; RIR findings are investigative leads. When Linux memory symbols (ISF) are unavailable for a robot kernel, the skills instruct the agent to say so and pivot to disk/timeline evidence — never to fabricate output.
skills/ robot SKILL.md files (the contribution)
case-templates/ robotic-mower-incident template (MITRE-mapped RIR)
global/CLAUDE.md robot routing + cyber-physical constraints
install-robot-skills.sh overlay installer (run after official install.sh)
extras/standalone-mcp-demo/ earlier standalone MCP+offline demo (kept for reference, not the spine)
docs/ SIFT-tool → robot-artifact mapping, datasets