Yamato-Security/hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
A star delta has been computed for 61,707 of 62,640 tracked repositories in this period, and only those can be ranked in it.
A repository missing here has not been measured far enough back yet. That does not mean it did not move.
Star counts measured between 00:28 and 02:33 (BKK).
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
A repository of sysmon configuration modules
A curated list of tools for incident response
Local-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the technique behind each detector. No agent, no daemon, no black box - between grep and a SIEM.
Rapidly Search and Hunt through Windows Forensic Artefacts
Awesome Security lists for SOC/CERT/CTI
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Valhuntir CLI — AI-augmented incident response platform
Cortex Analyzers Repository
Read-only MBR/GPT inspection, public file signature definitions, and synthetic disk image tools. AGPL-3.0-only.
IntelOwl: manage your Threat Intelligence at scale
Wireless ADB, over the internet; not just local Wi-Fi. An encrypted, censorship-resistant mesh VPN making remote forensics and network monitoring seamless.
Collaborative forensic timeline analysis
Your Everyday Threat Intelligence
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.
A cross platform forensic parser written in Rust!
Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.
A swarm of forensic agents, on your machine, on the record. Open-source agentic digital forensics and incident response under the AGPL: agents divide the case on a shared board, forge their own tools, and leave a hash-chained record.
macOS (& ios) Artifact Parsing Tool
Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.
Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.
Automate the creation of a lab environment complete with security tooling and logging best practices
a forensic carver with a soft heart · 基于 Rust、Tauri 2 与 Vue 3 的桌面磁盘取证与数据恢复工具：只读解析镜像、文件系统与加密卷，提供原类型预览、全局搜索、时间线、文件雕刻与插件分析
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
🐍 High-performance, multi-threaded YARA & IOC scanner
That's all 29 repositories in this period.
