Yamato-Security/hayabusa-evtx

Stars
6
Rank 2,539,965 (Top 51 %)
Language
Rust
License
Apache License 2.0
Created over 2 years ago
Updated 3 months ago

Yamato-Security/hayabusa-evtx

Yamato-Security

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

A fork of the evtx Rust crate for Hayabusa

hayabusa

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

WELA

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

EnableWindowsLogSettings

Documentation and scripts to properly enable Windows event logs.

hayabusa-rules

Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.

takajo

Takajō (鷹匠) is a Hayabusa results analyzer.

RustyBlue

RustyBlue is a rust implementation of DeepblueCLI, a forensics log analyzer for finding evidence of compromise from windows event logs.

hayabusa-sample-evtx

Sample evtx files to use for testing hayabusa detection rules

Presentations

sigma-to-hayabusa-converter

Documentation and tools to curate Sigma rules for Windows event logs into easier to parse rules.

hayabusa-encoded-rules

Encrypted Hayabusa and Sigma rules to avoid anti-virus false positives

suzaku-rules