Hayabusa Windows Event Log Analysis and Threat Hunting

Hayabusa is an open-source Windows event log analysis and threat-hunting tool developed by Yamato Security. Written in Rust, it uses multi-threading and Sigma-compatible detection rules to help security analysts investigate Windows activity, generate forensic timelines, and identify potentially suspicious events faster.

Instead of manually reviewing large volumes of Windows Event Log data, analysts can use Hayabusa to process event logs and consolidate relevant results into structured timelines. These outputs can then be reviewed with tools such as Timeline Explorer, LibreOffice, Elastic Stack, or Timesketch during digital forensics and incident response (DFIR).

Hayabusa Features for Windows Event Log Analysis

Hayabusa supports several investigation workflows, from examining a single computer to analyzing collected logs across an enterprise. Key capabilities include:

• Fast timeline generation: Processes Windows event logs using multi-threading to accelerate investigations.
• Sigma-compatible detections: Uses detection rules to identify event patterns associated with suspicious activity.
• Customizable rules: Supports rule-based detection that teams can adapt to their investigation requirements.
• Multiple output formats: Exports results in formats including CSV, JSON, and JSONL for further analysis.
• Live and offline analysis: Supports investigations on running systems and analysis of previously collected event logs.
• Enterprise threat hunting: Integrates with Velociraptor for broader collection, monitoring, and incident response workflows.

Hayabusa is written in Rust and uses detection rules to help reduce the amount of raw event data investigators need to examine. Detection results still require context and validation because legitimate administrative activity can resemble malicious behavior.

How Hayabusa Generates Forensic Timelines

Windows event logs can contain useful evidence about account activity, process execution, system changes, and other security-relevant events. However, the volume of records can make manual analysis slow. Hayabusa processes supported event logs, evaluates applicable detection rules, and organizes results into a timeline that investigators can filter and review.

Investigators can inspect the generated data using spreadsheet applications or dedicated timeline analysis tools. This makes it easier to correlate events, identify suspicious patterns, and prioritize records that deserve closer examination.

Sigma Rules and Threat Hunting

Sigma provides a widely used format for describing security detection logic across different platforms. Hayabusa supports Sigma-based detections alongside its own rules, allowing analysts to identify potentially suspicious Windows events using reusable detection content.

Teams can review available rules, adjust detection logic for their environment, and keep their rule sets updated as threats and investigation requirements change. Rule quality and compatibility matter, so analysts should review detections and test changes before using them in production investigations.

Enterprise-Wide DFIR with Velociraptor

For investigations involving multiple endpoints, Hayabusa can work with Velociraptor through its Hayabusa artifact. This combination supports collecting and analyzing event logs across managed systems, helping incident responders investigate activity that might otherwise remain scattered across individual machines.

Consolidated results can help teams investigate timelines across endpoints and prioritize suspicious activity. Hayabusa and Velociraptor can complement an existing SIEM or assist with retrospective investigations where centralized log analysis is limited, but they do not automatically replace every SIEM capability.

Hayabusa Startup and Results Review

The startup output provides information about the analysis process, including event log processing and detection-rule loading. The exact output depends on the version, configuration, input files, and selected analysis options.

For reliable results, preserve original event logs, record the tool version and configuration, and verify important findings against the underlying event records. Analysts investigating broader security incidents can also consult this guide to forensic tools and investigation workflows.

Download Hayabusa and Read the Documentation

Download the latest available release and review the official documentation before running an investigation. The project provides setup instructions, command references, detection-rule guidance, and information about importing results into analysis platforms.

• Hayabusa source code and releases
• Hayabusa detection rules
• Hayabusa artifact for Velociraptor

Use the official command reference for current options and syntax, and test the workflow against sample event logs before applying it to evidence from a live incident.