Related Project and Community hayabusa documentation

Other Windows Event Log Analyzers and Related Projects

There is no "one tool to rule them all" and we have found that each has its own merits so we recommend checking out these other great tools and projects and seeing which ones you like.

• APT-Hunter - Attack detection tool written in Python.
• Awesome Event IDs - Collection of Event ID resources useful for Digital Forensics and Incident Response
• Chainsaw - A similar sigma-based attack detection tool written in Rust.
• DeepBlueCLI - Attack detection tool written in Powershell by Eric Conrad.
• Epagneul - Graph visualization for Windows event logs.
• EventList - Map security baseline event IDs to MITRE ATT&CK by Miriam Wiesner.
• EvtxECmd - Evtx parser by Eric Zimmerman.
• EVTXtract - Recover EVTX log files from unallocated space and memory images.
• EvtxToElk - Python tool to send Evtx data to Elastic Stack.
• EVTX ATTACK Samples - EVTX attack sample event log files by SBousseaden.
• EVTX-to-MITRE-Attack - Another great repository of EVTX attack sample logs mapped to ATT&CK.
• EVTX parser - the Rust library we used written by @OBenamram.
• LogonTracer - A graphical interface to visualize logons to detect lateral movement by JPCERTCC.
• RustyBlue - Rust port of DeepBlueCLI by Yamato Security.
• Sigma - Community based generic SIEM rules.
• so-import-evtx - Import evtx files into Security Onion.
• SysmonTools - Configuration and off-line log visualization tool for Sysmon.
• Timeline Explorer - The best CSV timeline analyzer by Eric Zimmerman.
• Windows Event Log Analysis - Analyst Reference - by Forward Defense's Steve Anson.
• WELA (Windows Event Log Analyzer) - The swiff-army knife for Windows event logs by Yamato Security
• Zircolite - Sigma-based attack detection tool written in Python.

Windows Logging Recommendations

In order to properly detect malicious activity on Windows machines, you will need to improve the default log settings. We recommend the following sites for guidance:

• JSCU-NL (Joint Sigint Cyber Unit Netherlands) Logging Essentials
• ACSC (Australian Cyber Security Centre) Logging and Fowarding Guide
• Malware Archaeology Cheat Sheets

Sysmon Related Projects

To create the most forensic evidence and detect with the highest accuracy, you need to install sysmon. We recommend the following sites:

• Sysmon Modular
• TrustedSec Sysmon Community Guide

Community Documentation

English

• 2022/01/24 Graphing Hayabusa results in neo4j by Matthew Seyer (@forensic_matt)

Japanese

• 2022/01/22 Visualizing Hayabusa results in Elastic Stack by @kzzzzo2
• 2021/12/31 Intro to Hayabusa by itiB (@itiB_S144)
• 2021/12/27 Hayabusa internals by Kazuminn (@k47_um1n)