Yamato-Security/hayabusa-sample-evtx

Stars
38
Rank 702,844 (Top 14 %)
Language
Created almost 3 years ago
Updated over 1 year ago

Yamato-Security/hayabusa-sample-evtx

Yamato-Security

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Sample evtx files to use for testing hayabusa detection rules

hayabusa

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

WELA

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

EnableWindowsLogSettings

Documentation and scripts to properly enable Windows event logs.

hayabusa-rules

Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.

takajo

Takajō (鷹匠) is a Hayabusa results analyzer.

RustyBlue

RustyBlue is a rust implementation of DeepblueCLI, a forensics log analyzer for finding evidence of compromise from windows event logs.

Presentations

hayabusa-evtx

A fork of the evtx Rust crate for Hayabusa

hayabusa-encoded-rules

Encrypted Hayabusa and Sigma rules to avoid anti-virus false positives

sigma-to-hayabusa-converter

Tool to convert Windows event log based Sigma rules to Hayabusa compatible rules.

suzaku-rules