Hayabusa
DFIR · Intermediate
Fast Windows EVTX hunting and timeline.
Knowledge reference only. Prefer in-browser Labs first. Use this tool only on systems you own or have written authorization to test.
What to learn
- Sigma rules
- JSON/CSV output
Example commands (lab VMs only)
- hayabusa.exe evtx -d ./evtx/Hunt in lab logs