← all datasets
from the project README
◆ Detection rules
Yamato Security Hayabusa Rules
license: see sourceCurated Windows event log Sigma rules and config files used by Hayabusa and Velociraptor's built-in Sigma support.
Summary
Curated Sigma detection rules and Hayabusa rules for Windows event log analysis. Detection rules and config files used by Hayabusa and Velociraptor's built-in Sigma support.
- Formats
sigmayaml- License
- license: see source
- Added
- 2026-09-10
Get it
From the project’s own instructions where it documents any; otherwise a plain clone.
-
$ git clone --depth 1 https://github.com/Yamato-Security/hayabusa-rules
Shallow clone: history isn’t needed for testing.
Contents
5,048 files 30.8 MB repository
-
.yml4,984 -
.yaml23 -
.txt15 -
.md9 -
.png8 -
.py3 -
.toml3 -
.csv1
Use it with
Commands are curated, not yet run by us.
sigma-cli — Convert a Sigma rule to a Splunk search (install the backend first with `sigma plugin install splunk`).
$ sigma convert -t splunk --without-pipeline sample.yml
chainsaw — Hunt through your own EVTX logs with the collection's Sigma rules, using Chainsaw's bundled mapping file.
$ chainsaw hunt logs/ -s ./hayabusa-rules/rules --mapping mappings/sigma-event-logs-all.yml