Curated Sigma detection rules and Hayabusa rules for Windows event log analysis.
Detection rules and config files used by Hayabusa and Velociraptor's built-in Sigma support.

📖 Read the Rules Documentation →

---

📖 Documentation

How to write and use these rules — rule file format, detection fields, field modifiers, Sigma correlations, deprecated features and rule-creation advice — now lives on the Hayabusa documentation site:

👉 yamato-security.github.io/hayabusa/rules

Topic
📝 Creating Rule Files	Rule file format and structure
🔎 Detection Fields	Selection, field modifiers, wildcards, conditions
🧮 Sigma Correlations	Event count, value count and temporal rules
🧩 Field Modifiers	Supported modifiers reference
🗑️ Deprecated Features	Deprecated keywords and count rules
💡 Rule Creation Advice	Tips for writing good rules

🦅 About these rules

This repository contains curated Sigma rules that detect attacks in Windows event logs. It is used mainly for Hayabusa detection rules and config files, as well as Velociraptor's built-in Sigma detection.

Compared with the upstream Sigma repository, these rules:

• include only rules that most Sigma-native tools can parse;
• de-abstract the logsource field by adding the necessary Channel, EventID, etc. to reduce false positives;
• add converted process_creation and registry rules so they detect on built-in Windows logs, not just Sysmon.

Rules live in the hayabusa/ and sigma/ directories. Please file rule issues and pull requests in this repository (not the main Hayabusa repository).

🗂️ Looking for the old README?

The previous single-page README is preserved unchanged:

• 📄 OLD-README.md — English
• 📄 OLD-README-Japanese.md — 日本語

📜 License

The rules in this repository are released under the Detection Rule License (DRL) 1.1.

---

Maintained by Yamato Security  ·  @SecurityYamato