Check out the "DEaTH by Windows: Detection Engineering and Threat Hunting with Yamato Security Tools and AI / Windows DFIR with Yamato Security Tools" training at CODE BLUE with Yamato Security & Hayabusa's project leader if you want to level up your skills with Windows event log analysis, detection engineering with Sigma, etc... and attend the best security conference in Japan, CODE BLUE! Nov. 13-15 (Training) & Nov. 17-18 (Conference). 330,000 JPY (Approx. 2000 USD) for 3 days of training tax included. The CODE BLUE conference ticket (128,000 JPY / Approx. 800 USD) is also included so you can't get a better deal than this! The Yen is probably going to get stronger so buy ASAP for the cheapest exchange rates. Also this course sold out quickly last year so please register soon if you are planning to attend. The training will be provided in both Japanese and English. You can attend in-person or online if you can't make it to Japan. All of the training videos will be pre-recorded so if you can't make the training, you can take the training on-demand at your own pace. Details: codeblue.jp/files/detail_dea… Registration: codeblue.jp/en/program/train…

For anyone who wants to check out @r3nzsec 's amazing IRFlow Timeline (to replace Timeline Explorer) but have to use Windows or Linux, I compiled binaries for those platforms. Feel free to submit issues if you find any bugs. DFIRなどでTimeline Explorerより遥かに優れている「IRFlow Timeline」を使いたいけど、Macを持っていない！という方のために、Windows版とLinux版のリリースパッケージを作りました。 Windows Binary: github.com/Yamato-Security/i… Linux Binary: github.com/Yamato-Security/i… Website: r3nzsec.github.io/irflow-tim…

Thanks to everyone who came out to see our ( @PINKSAWTOOTH , @nishikawaakira , Fukusuke Takahashi) Black Hat Arsenal & DEFCON Demo Labs talks! Summary: 1. Hayabusa is now v4 with the dfir-timeline command to replace csv-timeline and json-timeline commands. 2. We released Mecha Hayabusa, our AI automation tool for analysis and report generation. 3. Suzaku got updated to v2 with Azure log support. We still need to normalize Azure Sigma rules upstream and add more rules but it is a good start. We now have over 750 AWS rules so Suzaku should be able to provide useful timelines for AWS CloudTrail logs. 4. We released Senrigan, a great new WebUI to visualize Suzaku results as well as AWS CloudTrail logs that is not reliant on signatures for detections If you missed our talks, you can view the slides from the links below: 1. github.com/Yamato-Security/P… 2. github.com/Yamato-Security/P… 3. github.com/Yamato-Security/P… Give the tools a try and let us know your feedback! Black Hat Arsenal & DEFCON Demo Labsで私たちの発表を見に来てくださった皆さん、ありがとうございました！ まとめ： 1. Hayabusaはv4になり、従来のcsv-timelineおよびjson-timelineコマンドに代わる新しいdfir-timelineコマンドを追加しました。 2. Mecha Hayabusa: 解析やレポート生成を自動化するためのAIツールをリリースしました。 3. Suzakuをv2にアップデートし、Azureログに対応しました。Azure向けSigmaルールについては、まだ上流側での正規化やルール追加が必要ですが、良いスタートが切れたと思います。また、AWS向けルールは750個以上になったため、Suzakuを使ってAWS環境でも有用なタイムラインを生成できるようになりました。 4. Senrigan: Suzakuの解析結果やAWS CloudTrailログを可視化するための新しいWeb UIツールをリリースしました。検知にシグネチャへ依存しない点も大きな特徴です。 発表を見逃した方は、以下のリンクからスライドをご覧いただけます: 1. github.com/Yamato-Security/P… 2. github.com/Yamato-Security/P… 3. github.com/Yamato-Security/P… ぜひツールを使ってみて、感想やフィードバックをお聞かせください！

Today is our official launch of "Mecha Hayabusa"! If analyzing Windows event logs with Hayabusa wasn't easy enough, you can now automate the analysis portion with AI and have 80-90% of the alert triage, FP reduction, investigation and report writing finished within a 1-2 hours. We will be presenting about how we do this, the challenges and how we overcome them and more at Black Arsenal station 4 today at 11:20. Come stop by and check it out if you are interested! blackhat.com/us-26/arsenal/s…

Programmers blame “bugs” for the problems in their code — tiny insects wreaking havoc in their machines. How absurd! After years of research, I’ve uncovered the real truth: they’re not bugs at all, but Yōkai! I’ve published my findings in the IT Yōkai Collection, revealing the real spirits haunting your devices. Happy Halloween 👻💻🎃 github.com/Yamato-Security/I…