Episode 15 -Windows event log analysis with Hayabusa. The Sigma-based log analysis tool

TLP - The Digital Forensics Podcast

Content provided by Clint Marsden. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Clint Marsden or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://podcastplayer.com/legal.

7M ago 23:20

MP3•Episode home

Send us a text

Key Takeaways:

Introduction to Hayabusa: Hayabusa is an open-source Windows Event Log Analysis Tool used for processing EVTX logs to detect suspicious activities in Windows environments.
Critical Alerts Detection: The tool is capable of detecting a variety of suspicious activities, including WannaCry ransomware and unauthorized Active Directory replication.
Efficient Incident Response: Hayabusa is ideal for incident response workflows, enabling teams to quickly triage and analyze Windows logs to detect potential breaches or malicious activity.
Importance of Informational Alerts: Informational alerts can indicate early reconnaissance phases of attacks and should not be dismissed.
Hypothesis-Driven Threat Hunting: Build a threat hunting hypothesis using MITRE ATT&CK or industry-specific threat intelligence to narrow the focus of the search.
Integration with SIEM and TimeSketch: Hayabusa supports integration with security tools like SIEM and can export logs into TimeSketch for further analysis and visualization.
Open-source and Free: Hayabusa is freely available to the cybersecurity community, making it an essential tool for threat detection without added cost.

19 episodes

#Tech #Clint Marsden #DFIR #Incident Response #Forensic #Cyber #Windows #Hacking #Blue Teaming #Red Team #Auscert

Episode 15 -Windows event log analysis with Hayabusa. The Sigma-based log analysis tool

TLP - The Digital Forensics Podcast

published 7M ago

MP3•Episode home

Send us a text

Key Takeaways:

Introduction to Hayabusa: Hayabusa is an open-source Windows Event Log Analysis Tool used for processing EVTX logs to detect suspicious activities in Windows environments.
Critical Alerts Detection: The tool is capable of detecting a variety of suspicious activities, including WannaCry ransomware and unauthorized Active Directory replication.
Efficient Incident Response: Hayabusa is ideal for incident response workflows, enabling teams to quickly triage and analyze Windows logs to detect potential breaches or malicious activity.
Importance of Informational Alerts: Informational alerts can indicate early reconnaissance phases of attacks and should not be dismissed.
Hypothesis-Driven Threat Hunting: Build a threat hunting hypothesis using MITRE ATT&CK or industry-specific threat intelligence to narrow the focus of the search.
Integration with SIEM and TimeSketch: Hayabusa supports integration with security tools like SIEM and can export logs into TimeSketch for further analysis and visualization.
Open-source and Free: Hayabusa is freely available to the cybersecurity community, making it an essential tool for threat detection without added cost.

19 episodes

#Tech #Clint Marsden #DFIR #Incident Response #Forensic #Cyber #Windows #Hacking #Blue Teaming #Red Team #Auscert

All episodes

Welcome to Player FM!

Player FM is scanning the web for high-quality podcasts for you to enjoy right now. It's the best podcast app and works on Android, iPhone, and the web. Signup to sync subscriptions across devices.

Listen to 500+ topics

Similar to TLP - The Digital Forensics Podcast

Podcasts Worth a Listen

TLP - The Digital Forensics Podcast « » Episode 15 -Windows event log analysis with Hayabusa. The Sigma-based log analysis tool

Episode 15 -Windows event log analysis with Hayabusa. The Sigma-based log analysis tool

Podcasts Worth a Listen

Welcome to Player FM!

Similar to TLP - The Digital Forensics Podcast

TLP - The Digital Forensics Podcast « »
Episode 15 -Windows event log analysis with Hayabusa. The Sigma-based log analysis tool