Generate realistic synthetic security logs for cybersecurity threat hunting training and research
☆299Nov 11, 2026Updated this week
Alternatives and similar repositories for EvidenceForge
Users that are interested in EvidenceForge are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Adversarial Detection Engineering knowledge base — ADE taxonomy, worked technique files, platform bug patterns, mitigations, and purple-t…☆88Sep 30, 2026Updated last month
- Secrets scanner with a twist... this is for getting threat actor credentials from MALWARE. Acquire TA creds from FLOSS exports, memdumps…☆43Aug 9, 2026Updated 3 months ago
- Framework-agnostic log sanitizer for browsers and Node.js. Redacts secrets and infrastructure identifiers with stable HMAC tokens so even…☆51Oct 14, 2026Updated 3 weeks ago
- Convert Sigma rules to SIEM queries, directly in your browser.☆125Oct 24, 2026Updated 2 weeks ago
- ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.☆411Updated this week
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- An AI-backed threat hunting assistant that aligns to the PEAK framework.☆66Jun 1, 2026Updated 5 months ago
- ☆28Updated this week
- A community-driven repository for threat hunting ideas, methodologies, and research that serves as a central gathering place for hunters …☆361Updated this week
- EntraTrace is a defensive security research tool for tracking and identifying the behavior of offensive tooling targeting Microsoft Entra…☆122Updated this week
- Cross-platform incident response toolkit. 28 pre-built use cases in a single zero-install binary: triage, threat hunting, memory forensic…☆162Jul 28, 2026Updated 3 months ago
- A framework and taxonomy for identifying, classifying, and reasoning about detection logic bugs in SIEM, EDR, and XDR rules, with concret…☆67Oct 29, 2026Updated 2 weeks ago
- A self-verifying autonomous DFIR analyst: read-only MCP forensic tools plus an adversarial Investigator/Skeptic self-correction loop.☆28Jun 10, 2026Updated 5 months ago
- DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret …☆392Sep 8, 2026Updated 2 months ago
- Helping defenders learn and validate npm supply-chain detections with safe atomic tests.☆35Oct 30, 2025Updated last year
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.☆238Oct 27, 2026Updated 2 weeks ago
- A curated collection of DFIR skills and workflows for InfoSec practitioners.☆325May 14, 2026Updated 5 months ago
- Agentic DFIR☆103Updated this week
- how to strangle threats☆70Updated this week
- MCP to help Defenders Detection Engineer Harder and Smarter☆525Nov 4, 2026Updated last week
- An Open Harness and Benchmark for AI in Cybersecurity Operations.☆69Updated this week
- MacOS forensic collector for Velociraptor. 70 artefacts covering browsers, communications, user activity, persistence, security, logs, fi…☆17May 26, 2026Updated 5 months ago
- A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chain…☆162Updated this week
- DFIR system for FindEvil Hackathon Submission☆39Aug 24, 2026Updated 2 months ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Your Browser-based EVTX Companion☆123Jul 21, 2026Updated 3 months ago
- ☆22Jul 13, 2026Updated 3 months ago
- Forensic extractor for Claude Code and Claude Cowork local state — macOS/Windows captures☆27Jun 16, 2026Updated 4 months ago
- Autonomous DFIR agent — SANS SIFT Workstation MCP server for incident response☆69Oct 30, 2026Updated last week
- Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account requi…☆532Updated this week
- This repository contains the research and components of our research into using Sigma for AWS Incident Response.☆38Jul 12, 2023Updated 3 years ago
- Always-on, cross-platform telemetry daemon for AI agent activity. Sysmon for AI agents.☆63Jul 28, 2026Updated 3 months ago
- A threat hunting process☆153Nov 4, 2026Updated last week
- KustoHawk is a lightweight incident triage and response tool designed for effective incident response in Microsoft Defender XDR and Micro…☆161Apr 1, 2026Updated 7 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- A repository containing the research output from my GCFE Gold Paper which compared Windows 10 and Windows 11.☆27Jul 27, 2022Updated 4 years ago
- Detection engineering with durable memory, a five-stage lifecycle, and an agentic surface — the sibling of ATHF.☆37Updated this week
- A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.☆290Sep 23, 2025Updated last year
- Native sigma scanner for Linux logs☆18Updated this week
- Remote access and Antivirus Logging Database☆45Apr 27, 2026Updated 6 months ago
- A preconfigured Velociraptor triage collector☆81Updated this week
- The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifa…☆669Updated this week
Are these results useful?