Windows Event Log Threat Hunting with Hayabusa and Sigma
Ran Hayabusa csv-timeline over 361 EVTX files with the full rule set (4,151 detection rules: 167 Hayabusa + 3,984 Sigma). After channel filtering, 2,031 rules ran against 16 relevant logs. Of 4,419 events, 2,983 produced hits (32.5% reduction), collapsing to 33 unique detections: 0 critical, 3 high, 66 medium, 1,573 low, 1,347 informational. All 3 high alerts were log-clearing (Important Log File Cleared x2, Log Cleared x1), a classic anti-forensics signal. Loaded the CSV into Timeline Explorer, grouped by Level then Rule Title, and reconstructed the anti-forensics window: six consecutive log-clear events at 10:18:28, then logoff and Event Log Service stopped seconds later.
Commands
1. Choose the detection subcommand
hayabusa.exe with no arguments lists the subcommands: csv-timeline and json-timeline for full detection output, plus logon-summary, eid-metrics, and search for quick pivots. csv-timeline is the one that produces a Timeline Explorer-ready file.
.\hayabusa.exe
2. Run the full detection timeline
Ran csv-timeline over the EVTX directory. The scan wizard offered rule set 5 (all event and alert rules, 4,417) and prompted for deprecated, unsupported, noisy, and sysmon rules. Including sysmon rules (3,685) added meaningful coverage. Total input: 361 EVTX files, 35.5 MB.
.\hayabusa.exe csv-timeline --directory C:\Tools\win10evtx\ -o win10-threatdetect.csv --no-color
3. Read the scan summary and data reduction
After channel filtering, 16 logs matched and 2,031 rules ran (167 Hayabusa + 3,984 Sigma = 4,151 total). Of 4,419 events, 2,983 produced hits, a 32.5% reduction. The value of a detection engine is exactly this: it tells you which fraction of events are worth an analyst's attention.
# scan summary section of the run
4. Triage by severity
The results summary broke 2,989 total detections into 33 unique: 0 critical, 3 high (2 unique), 66 medium, 1,573 low, 1,347 informational. Three high alerts is a list an analyst can actually read, which is the entire goal of running the engine first.
# results summary section
5. Read the top alerts and spot the anti-forensics
The top high alerts were all log-clearing: Important Log File Cleared (x2) and Log Cleared (x1). Top medium included Potentially Malicious PowerShell (57) and password guessing/spray. Log clearing at the top of the high list is the signal that someone tried to erase evidence.
# top alerts by severity
6. Group in Timeline Explorer and rebuild the sequence
Loaded the CSV into Timeline Explorer and dragged the Level and Rule Title headers to group. This collapsed 2,989 rows into a readable tree and exposed the anti-forensics window: six consecutive Log Cleared events at 10:18:28-29, then Logoff / RDS Session Logoff at 10:19:06, then Event Log Service Stopped at 10:19:08. The cell viewer showed the full EID 4104 ScriptBlock text for the PowerShell hits.
# Timeline Explorer: drag Level, then Rule Title, to the group bar
Key Findings
- 4,151 rules over 16 logs reduced 4,419 events to 33 unique detections (32.5% hit rate)
- All 3 high-severity alerts were log-clearing (anti-forensics)
- Top medium detection was Potentially Malicious PowerShell (57 hits)
- Timeline: six log-clears at 10:18:28, logoff at 10:19:06, Event Log Service stopped at 10:19:08
- EID 4104 script-block text was recoverable in the Timeline Explorer cell viewer
Security Controls
- Centralized log forwarding to a SIEM (logs off the host beat log clearing)
- Alerting on log-clear events (Security 1102, System 104)
- PowerShell script-block logging (EID 4104)
- Sigma rule coverage and tuning
- Baselining of logon and account-management event volume