Hayabusa — The Cyber Toolchain

Hayabusa v4.3.0

Wed, 28 Oct 2026 06:55:34 GMT

Hayabusa v4.3.0 adds `-Z, --timezone ` to six commands and extends unaliased rule-field resolution to `EventData` and `UserData`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `-Z, --timezone ` to `dfir-timeline`, `search`, `eid-metrics`, `logon-summary`, `log-metrics`, and `extract-base64` to render output timestamps with a fixed UTC offset in signed `+HH:MM` or `-HH:MM` form (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ `--timezone "+09:00"` or `-Z "-01:00"`); conflicts with `--utc` and `--iso-8601`; filtering, sorting, and histogram bins remain UTC-based. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v4.1.0

Sat, 12 Sep 2026 23:35:35 GMT

Hayabusa v4.1.0 adds `sort-csv` for post-scan deduplication and GeoIP enrichment for `logon-summary`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `sort-csv` command that sorts a Hayabusa CSV by `Timestamp`, deduplicates detections by comparing every column except `EvtxFile`, and accepts a single file via `-f, --file`, a directory of CSVs via `-d, --directory`, an output path via `-o, --output`, and `-C, --clobber` to overwrite.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `-G, --geo-ip` option to the `logon-summary` command, appending `Source ASN`, `Source Country`, and `Source City` columns for the source IP of each summarized logon. • Adds `First Logon`/`Last Logon` columns to the `logon-summary` successful logon table and `First Attempt`/`Last Attempt` columns to the failed logon table. • Expands `logon-summary` to aggregate RDP session events from Security event IDs `4778`/`4779`, Terminal Services RemoteConnectionManager/Operational `1149`, and LocalSessionManager/Operational `25`, in addition to the existing `21` and `302` sources. • Expands `extract-base64` to scan PowerShell event IDs `4100` and `4102` (Microsoft-Windows-PowerShell/Operational and PowerShellCore/Operational) and classic Windows PowerShell events `403`/`600`, checking the `ContextInfo` and `Payload` fields for `4100`/`4102` and `EventData.Data` detail blocks for `403`/`600`. • Adds Linux aarch64 (ARM64) musl release binary (`hayabusa--lin-aarch64-musl`), built with a correct aarch64 musl cross-toolchain. • Embeds `VERSIONINFO` metadata (product name, file description, company name, copyright, original filename) into Windows executables, with file and product versions auto-generated from `Cargo.toml`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v4.0.0

Mon, 03 Aug 2026 15:00:37 GMT

Hayabusa v4.0.0 merges csv-timeline and json-timeline into dfir-timeline, expands RDP and PowerShell coverage, and adds ARM64 Linux support. • New `dfir-timeline` command replaces `csv-timeline` and `json-timeline`, with output format selected via `-t, --output-type`: `-t csv` (default), `-t json`, or `-t jsonl` (case-insensitive); CSV-only flags `-M, --multiline`, `-S, --tab-separator`, and `-R, --remove-duplicate-data` now error if used with a non-CSV `-t`. • All command-line option long names standardized to lowercase: `--GeoIP`→`--geo-ip`, `--HTML-report`→`--html-report`, `--UTC`→`--utc`, `--ISO-8601`→`--iso-8601`, `--RFC-2822`/`--RFC-3339`→`--rfc-2822`/`--rfc-3339`, `--JSON-input`/`--JSON-output`→`--json-input`/`--json-output`, `--EID-filter`→`--eid-filter`; short flags unchanged. • `logon-summary` now counts RDP session events: Security EIDs `4778`/`4779` (session reconnect/disconnect with client workstation name and IP) and Terminal Services events RemoteConnectionManager/Operational `1149` and LocalSessionManager/Operational `25`, covering RDP activity even when `4624` events have been overwritten. • `extract-base64` now scans PowerShell event IDs `4100`/`4102` (Microsoft-Windows-PowerShell/Operational and PowerShellCore/Operational) across `ContextInfo` and `Payload` fields, and classic Windows PowerShell EIDs `403`/`600` via the `EventData.Data` blob. • Added `First Logon`/`Last Logon` columns to the `logon-summary` successful-logons table and `First Attempt`/`Last Attempt` columns to the failed-logons table. • New Linux aarch64 (ARM64) musl release binary (`hayabusa--lin-aarch64-musl`) built with a proper aarch64 musl cross toolchain. Breaking changes: • The `csv-timeline` and `json-timeline` commands are replaced by `dfir-timeline`; scripts invoking either old command must be updated. • The `-t` short flag is reassigned from `--threads` to `--output-type`; any use of `-t ` to set thread count must switch to `--threads `. • The `json-timeline` flag `-L, --JSONL-output` is removed; use `dfir-timeline -t jsonl` instead. • Long-form flags renamed: `--GeoIP`→`--geo-ip`, `--HTML-report`→`--html-report`, `--UTC`→`--utc`, `--ISO-8601`→`--iso-8601`, `--RFC-2822`→`--rfc-2822`, `--RFC-3339`→`--rfc-3339`, `--JSON-input`→`--json-input`, `--JSON-output`→`--json-output`, `--EID-filter`→`--eid-filter`; any scripts using the old uppercase forms will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v3.10.0

Sat, 04 Jul 2026 16:08:31 GMT

Hayabusa v3.10.0 adds Sigma 2.1 `|neq` field modifiers and per-tactic unique/total alert counts in MITRE ATT&CK output. • Supports Sigma 2.1 `|neq` and `|fieldref|neq` field modifiers, enabling negated comparisons composable with `|contains`, `|startswith`, `|endswith`, and `|fieldref` in detection rules. • Adds unique and total alert counts per MITRE ATT&CK tactic in detection results, giving practitioners a clearer picture of tactic coverage across a scan. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v3.9.0

Wed, 29 Apr 2026 23:40:33 GMT

Hayabusa v3.9.0 adds support for MITRE ATT&CK v19 threat taxonomy. • Supports MITRE ATT&CK v19, keeping tactic and technique mappings current with the latest framework revision. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v3.6.0

Thu, 25 Sep 2025 00:19:04 GMT

Hayabusa v3.6.0 improves Results Summary with first/last detection timestamps and cleaner empty-field handling for SIEM ingestion. • Outputs first and last detection timestamps (in addition to first/last event timestamps) in the `Results Summary` of `csv-timeline` and `json-timeline` commands. • Event and record IDs with multiple possibilities from correlation rules now output as empty strings instead of `-` for easier parsing. • Rule modified date outputs an empty string instead of `-` when not defined, easing SIEM import. • Empty rule metadata fields (e.g., `RuleModifiedDate`) are omitted from JSON output entirely, reducing file size and simplifying parsing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v3.4.0

Fri, 01 Aug 2025 15:20:03 GMT

Hayabusa v3.4.0 adds field-name abbreviations in search, 32-bit/64-bit OS compatibility, and filebeat-safe JSON/L output. • Adds automatic field-name abbreviations in the `search` command output, disableable with `-b, --disable-abbreviations`. • Enables the 32-bit Hayabusa binary to run on 64-bit operating systems. • Appends a trailing return character after the last line in JSON/JSONL output files so filebeat no longer misses the final event. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v3.2.0

Wed, 02 Apr 2025 22:39:45 GMT

Hayabusa v3.2.0 adds uptime/timezone to computer-metrics and first/last timestamps to default output. • Adds uptime and timezone info to the `computer-metrics` command output. • Adds first and last timestamp fields to the default scan output. • Improves checking and logging of invalid rules to surface rule problems more clearly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v3.1.1

Wed, 12 Mar 2025 02:54:39 GMT

Hayabusa v3.1.1 adds OS information to the computer-metrics command. • Adds OS information output to the `computer-metrics` command. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v3.1.0

Fri, 21 Feb 2025 20:36:06 GMT

Hayabusa v3.1.0 adds Emergency Alerts for critical systems, a new config-critical-systems command, and expands extract-base64 coverage. • New `emergency` severity level: add critical system hostnames (DCs, file servers) to `config/critical_systems.txt` and alerts automatically escalate one tier higher, with `critical` becoming `emergency`. • New `config-critical-systems` command automatically discovers domain controllers and file servers and populates `./config/critical_systems.txt`. • New `-X, --remove-duplicate-detections` option for `eid-metrics` and `logon-summary` commands to deduplicate results. • New `-S, --tab-separator` option in `csv-timeline`, `search`, and `log-metrics` commands to delimit field output with tabs. • Adds `--timeline-start` / `--timeline-end` time-range filtering options to the `search` command. • Expands `extract-base64` to cover PowerShell Classic EID 400 events, PowerShell Core logs, and System 7045 (Service Creation) events. • The `search` command gains a new `-s, --sort` option; results are now unsorted by default, yielding significantly lower memory usage and faster execution. • Adds `RuleID` field to all output profiles except `minimal`. Breaking changes: • The `-s, --sort-events` option is renamed to `-s, --sort`; any scripts or workflows using `--sort-events` will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v3.0.0

Wed, 25 Dec 2024 11:03:27 GMT

Hayabusa v3.0.0 adds base64 extraction, expand modifier support, and temporal correlation rules for threat hunting. • New `extract-base64` command extracts and decodes base64 strings from events. • New `expand-list` command outputs placeholder names used by rules with the `expand` modifier. • Supports the `expand` field modifier in detection rules. • Supports Temporal Proximity (`temporal`) correlation rules. • Supports Temporal Ordered Proximity (`temporal_ordered`) correlation rules. • Adds log file size output to the `log-metrics` command. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.19.0

Tue, 26 Nov 2024 02:17:09 GMT

Hayabusa v2.19.0 adds a new `log-metrics` command, comparison field modifiers, UTF-16 base64 chaining, RDP logon visibility, and abbreviation control. • New `log-metrics` command retrieves per-file `.evtx` metadata: computer names, event count, first/last timestamps, channels, and providers. • New `-b, --disable-abbreviations` option for `csv-timeline`, `json-timeline`, `eid-metrics`, `log-metrics`, and `search` commands to output raw Channel and Provider values instead of abbreviated forms. • Supports `gt`, `gte`, `lt`, `lte` field modifiers in detection rules for numeric/string comparisons. • Supports chaining `utf16`, `utf16be`, `utf16le`, and `wide` field modifiers with `base64offset|contains` for encoded content detection. • `logon-summary` command now surfaces logon information from RDP events, with additional detail when saving to a file. • `windash` characters are now dynamically loaded from `rules/config/windash_characters.txt`, allowing customization without rebuilding. Breaking changes: • The `--timeline-offset` option has been renamed to `--time-offset`; any scripts or workflows using `--timeline-offset` will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.18.0

Tue, 22 Oct 2024 23:21:21 GMT

Hayabusa v2.18.0 adds XOR-encoded rule bundles for AV evasion and new fieldref modifiers for flexible field-comparison detection. • Supports the `fieldref` modifier (alias for `equalsfield`) for comparing two fields in a Sigma rule. • Adds `fieldref|endswith` modifier as an alias for `endswithfield`, enabling field-to-field suffix comparisons. • Adds `fieldref|startswith` and `fieldref|contains` modifiers for prefix and substring field-to-field comparisons. • Supports XOR-encoded rule bundles (`encoded_rules.yml`) to minimize files on target systems and avoid antivirus false positives on rule content. • Loads `rules/config` files from a single `rules_config_files.txt` bundle, reducing the file footprint needed during live response. Breaking changes: • License changed from GPL-3.0 to AGPL-3.0, which may affect how you can distribute Hayabusa in your toolchain or products. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.17.0

Thu, 22 Aug 2024 23:24:05 GMT

Hayabusa v2.17.0 adds Sigma V2 modifier support (`|re:`, `|exists:`, `|cased:`) and ships low-memory mode on by default. • Supports Sigma V2 `|re:` submodifiers: `|re|i:` (case-insensitive), `|re|m:` (multi-line), and `|re|s:` (single-line dot-matches-newline) regex matching. • Supports Sigma V2 `|exists:` modifier for field-existence checks in detection rules. • Supports Sigma V2 `|cased:` modifier for explicit case-sensitive matching. • Adds `name` lookup support for Sigma correlation rules. • Low-memory mode is now on by default; `-s` flag is repurposed as `--sort-events` to explicitly sort events before output (high memory). • Sigma correlation reference rules no longer emit alerts by default; add `generate: true` to a rule to re-enable output. • `Data` fields in JSON output are now indexed (e.g., `Data[3]`) instead of emitted as a flat array, improving downstream parsing. • Aggregation rule alerts now include `Channel` and `EventID` even when multiple results are present. • JSON timeline outputs `{}` instead of `"-"` for empty `Details` fields, improving machine-parsability. • Updates MITRE ATT&CK tags to Sigma V2 format (e.g., `defense_evasion` → `defense-evasion`). • Config files in the `config` folder are now embedded in the binary, reducing file count for live analysis and Velociraptor deployments. Breaking changes: • The `-s, --low-memory-mode` flag is renamed to `-s, --sort-events`; existing scripts or workflows that passed `-s` to enable low-memory mode will now instead enable high-memory event sorting. • `-R, --remove-duplicate-data` and `-X, --remove-duplicate-detections` now require `-s, --sort-events` to be explicitly set; they no longer work without it. • JSON timeline output for empty `Details` fields changes from `"-"` to `{}`; parsers that expected the string `"-"` will break. • JSON `Data` field output changes from an array (`"Data": [...]`) to indexed keys (`"Data[3]"`, `"Data[4]"`, …); any downstream parser relying on the array format will break. • MITRE ATT&CK tags are reformatted to Sigma V2 style (e.g., `defense_evasion` → `defense-evasion`); tooling that matches on the underscore format will no longer match. • The `set-default-profile` command requires the `config` directory to be present on disk; it cannot run from the embedded-config binary alone. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.16.0

Tue, 11 Jun 2024 08:58:57 GMT

Hayabusa v2.16.0 adds channel-based filtering flags, Splunk REST API input, Sigma Correlation support, and multi-directory scanning • Adds `-A, --enable-all-rules` flag to `csv-timeline` and `json-timeline` subcommands to disable default Channel field filtering of detection rules • Adds `-a, --scan-all-evtx-files` flag to `csv-timeline` and `json-timeline` subcommands to load all .evtx files regardless of applicable rule channels • Adds support for analyzing Splunk logs exported from the REST API via a new input format • Adds `Event Count` and `Value Count` support for Sigma Correlation rules • Updates `-d, --directory` option in CLI to accept multiple directories for scanning • Adds `Provider_Name` field support and `Data[x]` notation in data mapping YAML files under `rules/config/data_mapping/` • Changes JSON output structure for count rules to separate field information into nested objects under the `Details` key Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.15.0

Sat, 20 Apr 2024 21:42:59 GMT

Hayabusa v2.15.0 adds `windash` field modifier support in Sigma rules. • Adds `windash` field modifier support (e.g., `|contains|windash:`) in Sigma rules to transform text for case-insensitive matching. Breaking changes: • Starting around the end of May, Hayabusa will stop converting `windash` internally and require rules to use `windash` as-is; updating to v2.15.0 is required to avoid rule parsing errors after that date. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.14.0

Fri, 29 Mar 2024 21:43:41 GMT

Hayabusa v2.14.0 adds `--include-status` rule filtering and `-s, --low-memory-mode`. • Adds `--include-status` option to filter rules by their status • Adds `-s, --low-memory-mode` option to reduce memory usage by up to 95% • JSON input now supports the format exported from Splunk Breaking changes: • -s, --low-memory-mode cannot be used in combination with `-R, --remove-duplicate-data` or `-X, --remove-duplicate-detections` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.13.0

Sun, 11 Feb 2024 01:50:19 GMT

Hayabusa v2.13.0 adds wildcard filter to `search`, JSON array input parsing, and `--help` flags. • Adds wildcard character support and exact match behavior to the `-f` (Filter) option in the `search` command • Adds a `-h, --help` flag to all Hayabusa commands via General Options • Enables parsing of JSON input sources where the data is nested inside an array Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.12.0

Sat, 23 Dec 2023 08:27:34 GMT

Adds MITRE ATT&CK tactic summary to HTML reports and changes JSON tag fields to arrays. • Adds a MITRE ATT&CK tactics summary to the HTML report for each detected computer. • Changes `%MitreTactics%`, `%MitreTags%`, and `%OtherTags%` output in JSON from strings to arrays of strings. Breaking changes: • JSON outputs for `%MitreTactics%`, `%MitreTags%`, and `%OtherTags%` are now arrays instead of strings, which may break scripts expecting a single string value. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.11.0

Mon, 04 Dec 2023 01:47:43 GMT

Hayabusa v2.11.0 adds PowerShell classic log field extraction with `--no-pwsh-field-extraction` flag • Adds `--no-pwsh-field-extraction` CLI argument to disable extraction of fields from PowerShell classic logs • Enhances the scan wizard to display rule count Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.10.1

Mon, 13 Nov 2023 01:27:43 GMT

Adds interactive questions to the scan wizard in Hayabusa v2.10.1 • Adds `questions` to the scan wizard to guide users during configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.10.0

Mon, 30 Oct 2023 21:06:41 GMT

Hayabusa v2.10.0 adds a scan wizard and tag filtering to pivot-keywords-list • Adds the `-w, --no-wizard` option to enable an interactive scan wizard for rule selection, with traditional execution restored via `--no-wizard` • Adds `--include-tag` option to the `pivot-keywords-list` command to load only rules matching specified tags • Adds `--exclude-tag` option to the `pivot-keywords-list` command to skip loading rules with specific tags Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.9.0

Fri, 22 Sep 2023 06:32:10 GMT

Hayabusa v2.9.0 adds better JSON parsing for count rules and optimizes thread defaults • The `Details` field in `count` rule JSON output is now a string for easier parsing • Changed the default thread count from CPU count to `std::thread::available_parallelism` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.8.0

Fri, 01 Sep 2023 11:48:17 GMT

Hayabusa v2.8.0 adds EVTX file carving, duplicate removal, timeline offsets, AND-logic search, and HexToDecimal field mapping. • Adds `-x, --recover-records` option to `csv-timeline` and `json-timeline` to recover evtx records through file carving in evtx slack space • Adds `%RecoveredRecord%` field to the output profile when using `--recover-records` • Adds `-X, --remove-duplicate-detections` option to `csv-timeline` and `json-timeline` to skip duplicate detection entries • Adds `--timeline-offset` option to `csv-timeline`, `json-timeline`, `logon-summary`, `eid-metrics`, `pivot-keywords-list`, and `search` commands to scan recent events based on a time offset • Adds `-a, --and-logic` option in the `search` command to search keywords with AND logic • Adds support for `HexToDecimal` in field mapping configuration files to convert hex values to decimal Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.4.0

Tue, 18 Apr 2023 21:42:59 GMT

Hayabusa v2.4.0 adds `search` subcommand with `-r/--regex` flag for keyword and pattern matching • Adds `search` command to search for specified keywords in records • Adds `-r, --regex` option in the `search` command to search for regular expressions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.3.3

Thu, 06 Apr 2023 23:58:20 GMT

Hayabusa v2.3.3 adds `-M` multiline rule author output and improves performance. • Improves processing speed by ~5% through CoW string optimization Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.3.2

Wed, 22 Mar 2023 05:12:36 GMT

Adds `-M, --multiline` flag to the `csv-timeline` command in Hayabusa v2.3.2 • `csv-timeline` supports `-M, --multiline` for multiline output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.3.1

Sat, 18 Mar 2023 11:49:03 GMT

Adds short-hand options `-D` and `-u`, quotes CSV fields in `csv-timeline` • Adds short-hand `-D` and `-u` flags for `--enable-deprecated-rules` and `--enable-unsupported-rules` respectively. • Quotes CSV fields in `csv-timeline` output to support multiple lines within a single field. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.3.0

Thu, 16 Mar 2023 12:26:27 GMT

Hayabusa v2.3.0 adds `|cidr` and `|contains|all` pipes, `* of selection` logic, and `--enable-unsupported-rules` flag • `--enable-unsupported-rules` CLI argument enables detection for rules marked as `unsupported` • `|cidr` pipe keyword adds CIDR matching capability in rules • `|contains|all` pipe keyword added to rule syntax • `1 of selection*` and `all of selection*` syntax now supported for rule conditions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.2.2

Wed, 22 Feb 2023 10:28:20 GMT

Hayabusa v2.2.2 adds `|base64offset|contains` pipe keyword and timestamp options to metrics/logon-summary • Added support for the `|base64offset|contains` pipe keyword. • Added Time Format options for `logon-summary` and `metrics` commands. • `metrics` command now displays first and last timestamps when using the `-d` directory option. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.2.0

Sat, 11 Feb 2023 14:44:33 GMT

Hayabusa v2.2.0 adds `-J` JSON input, `-G` GeoIP enrichment, and `-e` exact-level scanning • Adds `--JSON-input` (`-J`) CLI flag to read JSON-formatted event logs as new input source • Adds `-G, --GeoIP` CLI flag to enrich results with ASN organization, city, and country via MaxMind databases • Adds `-e, --exact-level` option to filter scan results for specific rule levels Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v2.0.0

Sat, 24 Dec 2022 02:20:18 GMT

Hayabusa v2.0.0 replaces help and usage commands with a subcommand-based interface • Switches command usage and help menu to be handled by subcommands instead of global flags or top-level arguments. Breaking changes: • The previous method for invoking help or usage (likely via a global flag like `--help` at the root level) is replaced by using dedicated subcommands, which may require updating existing scripts that rely on the old invocation pattern. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.9.0

Fri, 23 Dec 2022 00:44:43 GMT

Hayabusa v1.9.0 adds `|endswithfield` pipe keyword and `--debug` memory usage reporting • Adds the `|endswithfield` pipe keyword for rule authoring. • Adds the `--debug` CLI flag to display runtime memory utilization. Breaking changes: • The short option for `--visualize-timeline` has changed from `-V` to `-T`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.8.1

Mon, 21 Nov 2022 00:50:25 GMT

Adds %RenderedMessage% field to output profiles for WEC rendered log messages • Adds the `%RenderedMessage%` field to output profiles Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.7.2

Sun, 16 Oct 2022 21:50:09 GMT

Hayabusa v1.7.2 adds --list-profiles CLI option to discover output profiles • Adds `--list-profiles` flag to print available output profiles • Limits rule author names in detected alerts to 40 characters Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.7.1

Mon, 10 Oct 2022 06:02:28 GMT

Hayabusa v1.7.1 adds rule author display and channel/EID info configuration • Adds `rules/config/channel_eid_info.txt` to configure Channel and EID mappings for more accurate detection results. • Adds rule authors to standard output during scanning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.7.0

Thu, 29 Sep 2022 00:31:54 GMT

Hayabusa v1.7.0 adds HTML summary reports, metrics output options, and CSV export for logon data • Adds `-H, --html-report` flag to generate an HTML summary report • Adds `-M, --metrics` subcommand (replaces `-s, --statistics`) for Event ID analysis • Adds CSV output support (`-o, --output`) when using `-M` or `-L` options Breaking changes: • The `-s, --statistics` flag is removed and replaced by `-M, --metrics` • The `statistics_event_info.txt` output file is renamed to `event_id_info.txt` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.6.0

Fri, 16 Sep 2022 08:02:25 GMT

Adds `-j` and `-J` CLI options to export timeline results as JSON or JSONL files • Adds `-j, --json` option to save the analysis timeline to a JSON file. • Adds `-J, --jsonl` option to save the analysis timeline to a JSONL file. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.5.1

Fri, 19 Aug 2022 01:45:50 GMT

Adds Timesketch-compatible CSV output profile • Adds a new `timesketch` output profile that generates CSV format compatible with Timesketch imports Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.5.0

Thu, 18 Aug 2022 01:54:37 GMT

Hayabusa v1.5.0 adds customizable output profiles via config files and a `null` keyword for rule detection • Adds customizable output fields using `config/profiles.yaml` and `config/default_profile.yaml`. • Implements the `null` keyword in rules to check if a target field exists or not. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.4.2

Sun, 24 Jul 2022 02:19:31 GMT

Hayabusa v1.4.2 adds custom rule update paths and reduces output YAML size. • Adds ability to specify a custom directory for rule updates via `--rules` when used with `--update-rules` • Changes the saved detection rule path column from `RulePath` to `RuleFile` in output files to reduce file size Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.4.1

Thu, 30 Jun 2022 03:02:51 GMT

Hayabusa v1.4.1 adds `-D, --deep-scan`, moves rule configs to `rules/config/` for `-U, --update-rules` support • Adds the `-D, --deep-scan` flag to bypass the default Event ID filter and scan all events instead of only those with defined rules. Breaking changes: • The `channel_abbreviations.txt`, `statistics_event_info.txt` and `target_event_IDs.txt` files have moved from the `config` directory to the `rules/config` directory. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.4.0

Sun, 26 Jun 2022 12:28:29 GMT

Hayabusa v1.4.0 adds `--target-file-ext` for non-evtx logs and `--exclude-status` to filter rules by status field • Adds `--target-file-ext` CLI option to specify additional file extensions (e.g., `evtx_data`) beyond the default `.evtx` for scanning • Adds `--exclude-status` CLI option to ignore rule loading based on the rule's `status` field Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.3.1

Sun, 12 Jun 2022 23:33:41 GMT

Hayabusa v1.3.1 adds `--US-time`, `--US-military-time`, `--European-time` flags and multi-field indexing in rules • Adds `--US-time`, `--US-military-time`, and `--European-time` CLI arguments to specify custom output time formats • Adds `%Data[1]%` placeholder support in rule `details` fields to select specific named fields among duplicates • Adds loaded rules status summary displayed at startup Breaking changes: • The `-R` flag now defaults to hiding the record ID instead of displaying it; use `-R / --hide-record-id` explicitly to hide, and omit it (or use the new default behavior) to show. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.3.0

Mon, 06 Jun 2022 01:26:27 GMT

Hayabusa v1.3.0 adds `--visualize-timeline`, `-R` record ID display, and `--all-tags` CSV export. • `--visualize-timeline` (alias `-V`) enables a new event frequency timeline visualization feature • `-R` / `--display-record-id` adds the raw EVTX EventRecordID to output fields • `--all-tags` expands CSV exports to include all rule tags in the MitreAttack column Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.2.2

Thu, 19 May 2022 21:55:00 GMT

Hayabusa v1.2.2 adds `-L` logon summary and enables colored output by default • Adds `-L` / `--logon-summary` flag to generate a logon summary • Enables colored output for Command Prompt and PowerShell prompts by default Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.2.1

Fri, 22 Apr 2022 00:32:36 GMT

Adds a Channel column to output based on ./config/channel_abbreviations.txt for richer event context. • Adds `channel` output field driven by `./config/channel_abbreviations.txt` • Changes default path for level tuning rules from `./config/level_tuning.txt` to `./rules/config/level_tuning.txt` Breaking changes: • Level tuning is no longer read from `./config/level_tuning.txt`; must use `./rules/config/level_tuning.txt` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.2.0

Fri, 15 Apr 2022 07:56:48 GMT

Adds `-C`, `-p`, `-F`, `--level-tuning` flags and the `|equalsfield` rule aggregator to Hayabusa v1.2.0 • `-C / --config` flag added to specify a custom rules directory instead of the default location • `|equalsfield` aggregation keyword added for Sigma rules to compare if two fields are equal • `-p / --pivot-keywords-list` flag added to generate a list of keywords for pivoting investigations • `-F / --full-data` flag added to output all field information beyond the rule's `details` • `--level-tuning` flag added to tune detection risk levels using an external configuration file Breaking changes: • The event ID and title config file `timeline_event_info.txt` is renamed to `statistics_event_info.txt`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa

Hayabusa v1.1.0

Thu, 03 Mar 2022 00:22:29 GMT

Hayabusa v1.1.0 adds -r for single rule testing, -u for rule updates, and live analysis capabilities. • Adds `-r / --rules` option to specify a single rule for targeted testing • Adds `-u / --update-rules` flag to update rules from the `hayabusa-rules` repository • Adds `-l / --live-analysis` option to perform live analysis on Windows without specifying the event log directory • Adds `-c / --color` flag to enable True Color output for supported terminals Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hayabusa