In recent years, government agencies have displayed a growing interest in the prospect of detecting the activity of clandestine organizations. The clandestine organization and the government agencies who oppose them are an example of asymmetric warfare, which comes in contrast to traditional notions of armed conflict involving force-on-force scenarios where opposing sides can be measured according to force size, weapon assets, etc. We present an approach to the problem of detecting the execution of mission plans by the unconventional side in asymmetric warfare. The problem is to find threatening patterns of action in a data collection characterized as massive, relational, incomplete, noisy, and corrupt. In this paper we describe Sibyl: a system embodying a case-based reasoning (CBR) approach to automated plan detection. Sibyl features a "spanning case base" that covers the space of theoretical scenarios. Each case is used in a state-space search algorithm to adapt case elements to the data. Sibyl also features a graphical programming language that allows analysts to draw patterns to be found in an evidence database. We describe experimental results obtained for the Russian mafia domain used by DARPA's Evidence Extraction and Link Discovery (EELD) program.