TimothyVang/verdict-dfir

VERDICT — a DFIR agent (Claude Code as the engine) that produces a signed, offline-verifiable verdict. SANS Find Evil! 2026.

12Stars on the repository
12Mods indexed here, across every type
yesterdayLast push, which is what freshness is scored on
Apache-2.0Licence, which decides whether bodies are shown

PreToolUse

01

TimothyVang/verdict-dfir

Hook Claude Code

Runs before the agent uses a tool for Write, Write, Edit and Read tool calls, executing guard-root-writes.py and guard-outside-project.py via python3 (2 commands). From TimothyVang/verdict-dfir.

not rated 12 yesterday A tokens not measured original Apache-2.0