Hayabusa
A Sigma-based threat hunting and fast forensics timeline generator for Windows event logs, written in Rust.
What is Hayabusa?
Hayabusa is a Sigma-based threat hunting and fast forensics timeline generator for Windows event logs. It parses Windows event logs to detect malicious activity using Sigma rules and creates consolidated timelines for analysis, solving the problem of tedious and noisy log analysis in DFIR investigations.
Digital forensics and incident response (DFIR) analysts, threat hunters, and Windows system administrators who need to analyze Windows event logs for security investigations.
Developers choose Hayabusa for its speed, comprehensive Sigma rule support, and ability to generate easy-to-analyze timelines. It is the only open-source tool with full Sigma v2 correlation rule support and integrates seamlessly with Velociraptor for enterprise-wide threat hunting.
Overview
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Use Cases
Best For
- Generating fast forensics timelines from Windows event logs
- Threat hunting across enterprise endpoints using Sigma rules
- Analyzing Windows event logs for incident response investigations
- Integrating with Velociraptor for scalable DFIR workflows
- Extracting and decoding Base64 strings from event log data
- Creating pivot keyword lists to identify suspicious activity
Not Ideal For
- Environments with exclusively Linux or macOS logs and no Windows event logs to analyze
- Teams needing real-time, continuous SIEM alerting without retrospective analysis capabilities
- Simple log review tasks where basic command-line tools like grep or built-in Windows Event Viewer suffice
- Organizations requiring vendor-supported, certified tools for strict regulatory compliance audits
Pros & Cons
Pros
Hayabusa offers full Sigma specification support including v2 correlation rules, with over 4000 curated detection rules, providing broad coverage for Windows threat detection.
Written in memory-safe Rust with multi-threading, it delivers fast processing on Windows, Linux, and macOS, as evidenced by benchmarks showing up to 5x speed improvements.
Seamlessly integrates with Velociraptor via a dedicated artifact, enabling scalable DFIR across endpoints and effectively retrofitting SIEM capabilities in environments without one.
Includes advanced commands like logon summaries, pivot keyword lists, and Base64 extraction, aiding in deep-dive investigations and data correlation from event logs.
Cons
The README warns that anti-virus/EDR products often flag Hayabusa or its YAML rules due to keywords like 'mimikatz', requiring manual exclusions and potentially slowing first runs.
While it supports JSON input, its core functionality is optimized for Windows EVTX files, making it less suitable for heterogeneous environments with diverse log sources.
Managing thousands of YAML rules, config files, and tuning options (e.g., level-tuning, scan wizard) can be overwhelming, requiring significant expertise to avoid false positives.
Frequently Asked Questions
Related Projects
SigmaMain Sigma Rule Repository
ChainsawRapidly Search and Hunt through Windows Forensic Artefacts
LogonTracerInvestigate malicious Windows logon by visualizing and analyzing Windows event log
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.