A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider threats, and RAG/vector database attacks.
☆113Oct 12, 2026Updated this week
Alternatives and similar repositories for ai-dfir-toolkit
Users that are interested in ai-dfir-toolkit are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- APISignature is a plugin for x64dbg that help the malware analysts & reverse engineers during analysis by adding a reference for more tha…☆38Aug 15, 2026Updated 2 months ago
- LLM-native static vulnerability detection: point it at a repo and get a reviewable vuln report, the way a human auditor would.☆63Updated this week
- EAA is a curated catalog of techniques and real-world cases involving abuse of local AI agents through their runtime, configuration, stat…☆94Oct 3, 2026Updated 2 weeks ago
- Attack techniques for threat emulation in VMware environments☆55Aug 25, 2026Updated last month
- Research code for the paper "The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers" https://arxiv.org/abs/2602…☆39Mar 26, 2026Updated 6 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- EntraTrace is a defensive security research tool for tracking and identifying the behavior of offensive tooling targeting Microsoft Entra…☆122Updated this week
- Adversarial Detection Engineering knowledge base — ADE taxonomy, worked technique files, platform bug patterns, mitigations, and purple-t…☆81Sep 30, 2026Updated 2 weeks ago
- Automated adversary emulation (Caldera) against an AD lab to validate Sigma detection coverage and map results to MITRE ATT&CK.☆54Sep 25, 2026Updated 3 weeks ago
- Repository for various Beacon Object Files (BOFs)☆122Updated this week
- Agentic DFIR☆92Updated this week
- Rust based C2 Framework☆32Sep 29, 2026Updated 2 weeks ago
- A collection of PowerShell scripts for analyzing macOS Forensic Artifacts☆34Mar 16, 2026Updated 7 months ago
- REx@Skill - Agentic Reverse Engineering eXecution Skill for binary vulnerability discovery☆111Sep 23, 2026Updated 3 weeks ago
- Always-on, cross-platform telemetry daemon for AI agent activity. Sysmon for AI agents.☆61Jul 28, 2026Updated 2 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Portable passive hostname reconnaissance through Shodan CTL☆40Sep 5, 2026Updated last month
- Framework-agnostic log sanitizer for browsers and Node.js. Redacts secrets and infrastructure identifiers with stable HMAC tokens so even…☆22Sep 23, 2026Updated 3 weeks ago
- 🛡️ A curated list of resources on agent skills security: attacks, defenses, frameworks, and benchmarks for securing AI agent tool use an…☆262Updated this week
- Passive backdoor implant that sniffs for a covert magic-packet trigger and runs tasks written in a custom 23-opcode bytecode command lang…☆57Aug 26, 2026Updated last month
- Shattering the 1:10 barrier. A high-velocity alternative to Plaso for the modern IR landscape☆18Jul 6, 2026Updated 3 months ago
- Scripts to for ready-to-use Velociraptor instance deployment in Azure☆14Jun 27, 2023Updated 3 years ago
- hunt.md: an open, plain-text format for threat hunts. Spec, examples and tooling.☆41Sep 20, 2026Updated 3 weeks ago
- Contains compiled binaries of Volatility☆37May 18, 2025Updated last year
- A skill to help cybersecurity folks update and tweak their resume☆185Sep 20, 2026Updated 3 weeks ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- ☆25Apr 22, 2025Updated last year
- An Open Harness and Benchmark for AI in Cybersecurity Operations.☆66Updated this week
- All my walkthroughs for HTB Academy labs in the Active Directory Module ( CPTS path ). Includes folder of canvas files for Obsidian.☆67Apr 27, 2026Updated 5 months ago
- Workshop materials for “Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel” presented at DEF CON 34 and BSidesLV 20…☆397Aug 16, 2026Updated 2 months ago
- PowerShell tool to triage systems☆12May 17, 2023Updated 3 years ago
- BINNY: an open source agent harness for reverse engineering. Plug in any model, or a local one.☆150Updated this week
- A command-line tool for efficiently extracting files, directories, and alternate data streams directly from NTFS image files.☆23Oct 11, 2026Updated last week
- Volatility 3 ported to Rust. Same output, much faster.☆197Oct 6, 2026Updated last week
- Active Directory pentest methodology for Claude Code: skills, agents and slash commands for internal AD red-team work (Kerberoasting, ADC…☆212Aug 24, 2026Updated last month
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- A practical governance framework for organizations adopting the Model Context Protocol (MCP), the open standard that lets AI agents conne…☆91Sep 8, 2026Updated last month
- An AI-powered plugin for Caldera that orchestrates long-running LLM workflows to automatically create adversary emulation abilities and p…☆41Sep 3, 2026Updated last month
- Shellph is a portable command-line utility designed to automate encryption and obfuscation of arbitrary shellcode. Named after my cat (Be…☆36Jul 20, 2026Updated 2 months ago
- sharing some outputs for science☆24Sep 26, 2026Updated 3 weeks ago
- Regexplore is a Volatility plugin designed to mimic the functionality of the Registry Explorer plugins in EZsuite☆18Mar 31, 2023Updated 3 years ago
- ☆25Oct 9, 2024Updated 2 years ago
- A DFIR Incident Response AI bot using local Ollama LLM to derrive automated findings from logs☆17Jan 17, 2026Updated 9 months ago