Yamato Security 大和セキュリティ

All

13 repositories

hayabusa
Public
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
windows rust attack detection logs event threat forensics dfir response
Rust
•
GNU Affero General Public License v3.0
•203•2.3k•42•1•Updated Nov 12, 2024Nov 12, 2024
hayabusa-encoded-rules
Public
Encoded Hayabusa and Sigma rules to avoid anti-virus false positives and reduce files stored on target systems.
Rust
•
Other
•0•3•0•0•Updated Nov 11, 2024Nov 11, 2024
hayabusa-rules
Public
Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.
windows attack log analysis event dfir mitre sigma hayabusa
Python
•
Other
•23•143•5•0•Updated Nov 10, 2024Nov 10, 2024
takajo
Public
Takajō (鷹匠) is a Hayabusa results analyzer.
windows nim log analysis event nim-lang hayabusa
Nim
•
GNU Affero General Public License v3.0
•7•89•22•0•Updated Nov 9, 2024Nov 9, 2024
hayabusa-evtx
Public
A fork of the evtx Rust crate for Hayabusa
Rust
•
Apache License 2.0
•2•6•4•0•Updated Nov 6, 2024Nov 6, 2024
Presentations
Public
2•14•0•0•Updated Nov 5, 2024Nov 5, 2024
hayabusa-sample-evtx
Public
Sample evtx files to use for testing hayabusa detection rules
3•44•0•0•Updated Nov 4, 2024Nov 4, 2024
sigma-to-hayabusa-converter
Public
Documentation and tools to curate Sigma rules for Windows event logs into easier to parse rules.
Python
•
GNU General Public License v3.0
•0•5•6•0•Updated Oct 14, 2024Oct 14, 2024
suzaku-rules
Public
Other
•1•1•0•0•Updated Apr 30, 2024Apr 30, 2024
EnableWindowsLogSettings
Public
Documentation and scripts to properly enable Windows event logs.
windows auditing monitoring logs event forensics dfir sysmon sigma hayabusa
Batchfile
•
GNU General Public License v3.0
•51•553•1•0•Updated Sep 20, 2023Sep 20, 2023
.github
Public
0•1•0•0•Updated Aug 1, 2023Aug 1, 2023
WELA
Public
WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）
windows log analysis timeline logs event threat forensics dfir response
PowerShell
•
GNU General Public License v3.0
•82•762•9•0•Updated Feb 3, 2023Feb 3, 2023
RustyBlue
Public
RustyBlue is a rust implementation of DeepblueCLI, a forensics log analyzer for finding evidence of compromise from windows event logs.
Rust
•
MIT License
•6•68•1•0•Updated Oct 13, 2022Oct 13, 2022