fukusuket
commented
1 week ago csv-timeline
help
fukusuke@MacBookAir hayabusa-2.19.0-mac-aarch64 % ./hayabusa csv-timeline -h
Hayabusa v2.19.0 - Dev Build
Yamato Security (https://github.com/Yamato-Security/hayabusa - @SecurityYamato)
Usage:
hayabusa.exe csv-timeline <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory of multiple .evtx files
-f, --file <FILE> File path to one .evtx file
-l, --live-analysis Analyze the local C:\Windows\System32\winevt\Logs folder
General Options:
-C, --clobber Overwrite files when saving
-b, --disable-abbreviations Disable abbreviations
-h, --help Show the help menu
-J, --JSON-input Scan JSON formatted logs instead of .evtx (.json or .jsonl)
-w, --no-wizard Do not ask questions. Scan for all events and alerts
-Q, --quiet-errors Quiet errors mode: do not save error logs
-x, --recover-records Carve evtx records from slack space (default: disabled)
-r, --rules <DIR/FILE> Specify a custom rule directory or file (default: ./rules)
-c, --rules-config <DIR> Specify custom rule config directory (default: ./rules/config)
-s, --sort-events Sort events before saving the file. (warning: this uses much more memory!)
-t, --threads <NUMBER> Number of threads (default: optimal number for performance)
--target-file-ext <FILE-EXT...> Specify additional evtx file extensions (ex: evtx_data)
Filtering:
-E, --EID-filter Scan only common EIDs for faster speed (./rules/config/target_event_IDs.txt)
-A, --enable-all-rules Enable all rules regardless of loaded evtx files (disable channel filter for rules)
-D, --enable-deprecated-rules Enable rules with a status of deprecated
-n, --enable-noisy-rules Enable rules set to noisy (./rules/config/noisy_rules.txt)
-u, --enable-unsupported-rules Enable rules with a status of unsupported
-e, --exact-level <LEVEL> Only load rules with a specific level (informational, low, medium, high, critical)
--exclude-category <CATEGORY...> Do not load rules with specified logsource categories (ex: process_creation,pipe_created)
--exclude-computer <COMPUTER...> Do not scan specified computer names (ex: ComputerA) (ex: ComputerA,ComputerB)
--exclude-eid <EID...> Do not scan specific EIDs for faster speed (ex: 1) (ex: 1,4688)
--exclude-status <STATUS...> Do not load rules according to status (ex: experimental) (ex: stable,test)
--exclude-tag <TAG...> Do not load rules with specific tags (ex: sysmon)
--include-category <CATEGORY...> Only load rules with specified logsource categories (ex: process_creation,pipe_created)
--include-computer <COMPUTER...> Scan only specified computer names (ex: ComputerA) (ex: ComputerA,ComputerB)
--include-eid <EID...> Scan only specified EIDs for faster speed (ex: 1) (ex: 1,4688)
--include-status <STATUS...> Only load rules with specific status (ex: experimental) (ex: stable,test)
--include-tag <TAG...> Only load rules with specific tags (ex: attack.execution,attack.discovery)
-m, --min-level <LEVEL> Minimum level for rules to load (default: informational)
-P, --proven-rules Scan with only proven rules for faster speed (./rules/config/proven_rules.txt)
-a, --scan-all-evtx-files Scan all evtx files regardless of loaded rules (disable channel filter for evtx files)
--time-offset <OFFSET> Scan recent events based on an offset (ex: 1y, 3M, 30d, 24h, 30m)
--timeline-end <DATE> End time of the event logs to load (ex: "2022-02-22 23:59:59 +09:00")
--timeline-start <DATE> Start time of the event logs to load (ex: "2020-02-22 00:00:00 +09:00")
Output:
-G, --GeoIP <MAXMIND-DB-DIR> Add GeoIP (ASN, city, country) info to IP addresses
-H, --HTML-report <FILE> Save Results Summary details to an HTML report (ex: results.html)
-M, --multiline Output event field information in multiple rows
-F, --no-field-data-mapping Disable field data mapping
--no-pwsh-field-extraction Disable field extraction of PowerShell classic logs
-o, --output <FILE> Save the timeline in CSV format (ex: results.csv)
-p, --profile <PROFILE> Specify output profile
-R, --remove-duplicate-data Duplicate field data will be replaced with "DUP"
-X, --remove-duplicate-detections Remove duplicate detections (default: disabled)
Display Settings:
--no-color Disable color output
-N, --no-summary Do not display Results Summary for faster speed
-q, --quiet Quiet mode: do not display the launch banner
-v, --verbose Output verbose information
-T, --visualize-timeline Output event frequency timeline (terminal needs to support unicode)
Time Format:
--European-time Output timestamp in European time format (ex: 22-02-2022 22:00:00.123 +02:00)
-O, --ISO-8601 Output timestamp in original ISO-8601 format (ex: 2022-02-22T10:10:10.1234567Z) (Always UTC)
--RFC-2822 Output timestamp in RFC 2822 format (ex: Fri, 22 Feb 2022 22:00:00 -0600)
--RFC-3339 Output timestamp in RFC 3339 format (ex: 2022-02-22 22:00:00.123456-06:00)
--US-military-time Output timestamp in US military time format (ex: 02-22-2022 22:00:00.123 -06:00)
--US-time Output timestamp in US time format (ex: 02-22-2022 10:00:00.123 PM -06:00)
-U, --UTC Output time in UTC format (default: local time)--disable-abbreviations option
% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/Antivirus -q -w -b
Start time: 2024/11/15 11:10
Total event log files: 2
Total file size: 2.2 MB
Loading detection rules. Please wait.
Excluded rules: 26
Noisy rules: 12 (Disabled)
Deprecated rules: 216 (5.01%) (Disabled)
Experimental rules: 373 (8.65%)
Stable rules: 241 (5.59%)
Test rules: 3,700 (85.77%)
Unsupported rules: 42 (0.97%) (Disabled)
Correlation rules: 3 (0.07%)
Correlation referenced rules: 3 (0.07%)
Hayabusa rules: 175
Sigma rules: 4,139
Total detection rules: 4,314
Creating the channel filter. Please wait.
Evtx files loaded after channel filter: 2
Detection rules enabled after channel filter: 29
Output profile: standard
Scanning in progress. Please wait.
Timestamp ยท RuleTitle ยท Level ยท Computer ยท Channel ยท EventID ยท RecordID ยท Details ยท ExtraFieldInfo
2020-12-11 21:28:01.299 +09:00 ยท Defender Alert (High) ยท high ยท WIN10-client01.offsec.lan ยท Microsoft-Windows-Windows Defender/Operational ยท 1116 ยท 171 ยท Threat: HackTool:Win64/Mikatz!dha ยฆ Severity: High ยฆ Type: Tool ยฆ User: OFFSEC\admmig ยฆ Path: file:_C:\Users\admmig\Documents\mimidrv.sys ยฆ Proc: C:\Windows\explorer.exe ยท Action ID: 9 ยฆ Action Name: Not Applicable ยฆ Additional Actions ID: 0 ยฆ Additional Actions String: No additional actions required ยฆ Category ID: 34 ยฆ Detection ID: {82C6A580-0C4C-48BD-A0AC-6D3DE58FDABB} ยฆ Detection Time: 2020-12-11T12:28:01.177Z ยฆ Engine Version: AM: 1.1.17600.5, NIS: 1.1.17600.5 ยฆ Error Code: 0x00000000 ยฆ Error Description: The operation completed successfully. ยฆ Execution ID: 1 ยฆ Execution Name: Suspended ยฆ FWLink: https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:Win64/Mikatz!dha&threatid=2147705511&enterprise=0 ยฆ Origin ID: 1 ยฆ Origin Name: Local machine ยฆ Post Clean Status: 0 ยฆ Pre Execution Status: 0 ยฆ Product Name: Microsoft Defender Antivirus ยฆ Product Version: 4.18.2011.6 ยฆ Security intelligence Version: AV: 1.327.2245.0, AS: 1.327.2245.0, NIS: 1.327.2245.0 ยฆ Severity ID: 4 ยฆ Source ID: 3 ยฆ Source Name: Real-Time Protection ยฆ State: 1 ยฆ Status Code: 1 ยฆ Threat ID: 2147705511 ยฆ Type ID: 0 ยฆ Type Name: Concrete
What Changed
-aoption was already in use, I temporarily set it to the-boption.The command to which this option is added
Evidence
Integration-Test
I would appreciate it if you could check it out when you have time๐