Sample evtx files to use for testing hayabusa detection rules
☆72Nov 5, 2025Updated last year
Alternatives and similar repositories for hayabusa-sample-evtx
Users that are interested in hayabusa-sample-evtx are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.☆232Updated this week
- Takajō (鷹匠) is a Hayabusa results analyzer.☆168Oct 25, 2026Updated last week
- A fork of the evtx Rust crate for Hayabusa☆15Oct 8, 2026Updated 3 weeks ago
- Documentation and tools to curate Sigma rules for Windows event logs into easier to parse rules.☆16Oct 25, 2026Updated last week
- Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.☆646May 21, 2026Updated 5 months ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Rust-based Fast Forensics Tool for Windows☆15Aug 9, 2026Updated 2 months ago
- A DFIR Incident Response AI bot using local Ollama LLM to derrive automated findings from logs☆18Jan 17, 2026Updated 9 months ago
- Documentation and scripts to properly enable Windows event logs.☆725Oct 3, 2025Updated last year
- WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）☆774Feb 3, 2023Updated 3 years ago
- RustyBlue is a rust implementation of DeepblueCLI, a forensics log analyzer for finding evidence of compromise from windows event logs.☆73Oct 13, 2022Updated 4 years ago
- Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.☆3,441Updated this week
- Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.☆237Oct 27, 2026Updated last week
- Windows Event Log Knowledge Base☆36Sep 27, 2026Updated last month
- ☆22Updated this week
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- Get-MiniTimeline - Triage Collection and Timeline Generation w/ KAPE☆37May 25, 2024Updated 2 years ago
- This repository contains sample log data that were collected after running adversary simulations in Microsoft 365☆25Oct 9, 2024Updated 2 years ago
- Native sigma scanner for Linux logs☆17Updated this week
- ☆25Oct 9, 2024Updated 2 years ago
- AI analyzer for Hayabusa results.☆28Oct 25, 2026Updated last week
- Windows Event Log "Microsoft-Windows-Partition%4Diagnostic.evtx" parser and devices' VSNs extractor.☆20Nov 28, 2023Updated 2 years ago
- VelociraptorMCP is a Model Context Protocol bridge for exposing LLMs to MCP clients.☆96Jun 28, 2026Updated 4 months ago
- ☆16Updated this week
- A repository hosting example goodware evtx logs containing sample software installation and basic user interaction☆93Sep 14, 2026Updated last month
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- ☆16May 27, 2019Updated 7 years ago
- FJTA (Forensic Journal Timeline Analyzer) is a tool that analyzes Linux filesystem (ext4, XFS) journals (not systemd-journald logs), gene…☆114Apr 8, 2026Updated 6 months ago
- A series of functions to parse Teamviewer logs to answer specific questions☆10Jul 17, 2022Updated 4 years ago
- Tools and scripts to deploy and manage OpenRelik instances☆17Mar 23, 2026Updated 7 months ago
- Harness the power of Splunk for your investigations☆172Oct 6, 2026Updated last month
- A command-line tool for efficiently extracting files, directories, and alternate data streams directly from NTFS image files.☆22Updated this week
- ETW forensic tool for Volatility3 plugin☆17Nov 15, 2024Updated last year
- This Repository consists all Public Cheatsheets created by BlackPerl DFIR Content Team☆20Oct 9, 2024Updated 2 years ago
- Assist analyst and threat hunters to understand Windows authentication logs and to analyze brutforce scenarios.☆21Jul 1, 2023Updated 3 years ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Hunt the windows Registry automatically using VQL☆18Updated this week
- AIFT is a GUI, CLI, REST API, and MCP tool that helps DFIR analysts get oriented quickly. Point it at disk images, VM images, forensic ar…☆53Jun 13, 2026Updated 4 months ago
- An experimental Velociraptor implementation using cloud infrastructure☆26Oct 28, 2026Updated last week
- Windows Events Attack Samples☆2,642Jan 24, 2023Updated 3 years ago
- MAES: M365 Analyzer & Extractor Suite Po☆37Updated this week
- A tiny infrastructure for Codex to solve CTF challenges in reverse engineering. 3rd in Flare-On 13.☆27Sep 26, 2026Updated last month
- Bulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard☆20Updated this week