A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider threats, and RAG/vector database attacks.
☆155Nov 2, 2026Updated this week
Alternatives and similar repositories for ai-dfir-toolkit
Users that are interested in ai-dfir-toolkit are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆37Updated this week
- EntraTrace is a defensive security research tool for tracking and identifying the behavior of offensive tooling targeting Microsoft Entra…☆122Updated this week
- DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret …☆391Sep 8, 2026Updated 2 months ago
- A collection of PowerShell scripts for analyzing macOS Forensic Artifacts☆36Mar 16, 2026Updated 7 months ago
- my MSTICpy practice and custom tools repository☆11Apr 23, 2025Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- A repository to share publicly available Velociraptor detection content☆210Nov 1, 2026Updated last week
- macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR☆55Sep 13, 2026Updated last month
- ☆70Jan 8, 2026Updated 10 months ago
- Repo for experimenting and testing MCP server builds for CTI-related research.☆27May 13, 2025Updated last year
- MCP to help Defenders Detection Engineer Harder and Smarter☆522Updated this week
- Golang wrapper for Volatility3☆22Oct 2, 2026Updated last month
- DFIR LABS - A compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital For…☆672Sep 20, 2026Updated last month
- Scripts to for ready-to-use Velociraptor instance deployment in Azure☆14Jun 27, 2023Updated 3 years ago
- ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.☆409Oct 22, 2026Updated 2 weeks ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence tab…☆47Oct 15, 2026Updated 3 weeks ago
- LLM-native static vulnerability detection: point it at a repo and get a reviewable vuln report, the way a human auditor would.☆66Updated this week
- A curated collection of DFIR skills and workflows for InfoSec practitioners.☆325May 14, 2026Updated 5 months ago
- A Purple Team lab simulating Active Directory attacks (Kerberoasting, BloodHound, lateral movement) and implementing defensive hardening …☆39Oct 7, 2026Updated last month
- AuthStrike is an identity and authentication security testing tool for controlled simulations, security research, and education purpose o…☆22Sep 9, 2026Updated last month
- Project Sato - C2☆10Apr 24, 2025Updated last year
- CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, …☆622Oct 22, 2026Updated 2 weeks ago
- "Pure" powershell command (no dependencies, no special permissions etc') to retrieve change history in an AD group membership. relies on …☆12Nov 30, 2025Updated 11 months ago
- Awesome list of keywords and artifacts for Threat Hunting sessions☆684Aug 4, 2025Updated last year
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- Script that uses exiftool and c2pa to identify metadata tags that indicate AI generation☆15Dec 27, 2025Updated 10 months ago
- USN Journal full path builder☆71Apr 16, 2026Updated 6 months ago
- Utility tool to ingest CSV files into Kusto☆21Dec 17, 2025Updated 10 months ago
- Adversarial Detection Engineering knowledge base — ADE taxonomy, worked technique files, platform bug patterns, mitigations, and purple-t…☆88Sep 30, 2026Updated last month
- Adversarial security testing for AI agents — prompt injection, tool misuse, memory poisoning, and MCP scanning, with CI-ready regression …☆21Updated this week
- ☆17Aug 27, 2026Updated 2 months ago
- Autonomous DFIR agent — SANS SIFT Workstation MCP server for incident response☆69Oct 30, 2026Updated last week
- Helping defenders learn and validate npm supply-chain detections with safe atomic tests.☆35Oct 30, 2025Updated last year
- Your AI Assistant for Weekend Forensics☆39Updated this week
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- ☆77May 11, 2026Updated 5 months ago
- A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID☆690Oct 26, 2026Updated last week
- Attack techniques for threat emulation in VMware environments☆58Updated this week
- A PowerShell-based script to analyze network logs from CSV files and detect potential beaconing behavior. Supports VirusTotal integration…☆17May 11, 2025Updated last year
- Menu for Thor scanner lite☆20Oct 24, 2025Updated last year
- Interactive map of OAuth, Conditional Access, Entra Agent ID and MCP authentication flows, step by step☆69Updated this week
- Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.☆237Oct 27, 2026Updated last week