Stack Commands¶
stack-cmdlines command¶
This command will stack executed command lines by extracting information from Sysmon 1 and Security 4688 events.
- Input: JSONL
- Profile: Any besides
all-field-infoandall-field-info-verbose - Output: Terminal or CSV file
Required options:
-t, --timeline <JSONL-FILE-OR-DIR>: Hayabusa JSONL timeline file or directory of JSONL files
Options:
-l, --level: specify the minimum alert level (default:informational)-y, --ignoreSysmon: exclude Sysmon 1 events (default:false)-e, --ignoreSecurity: exclude Security 4688 events (default:false)-o, --output <CSV-FILE>: the CSV file to save the results to (default:stdout)-q, --quiet: do not display logo. (default:false)-s, --skipProgressBar: do not display the progress bar (default:false)
stack-cmdlines command examples¶
Output to terminal:
Save to CSV:
stack-computers command¶
This command will stack computer hostnames according to the Computer field.
- Input: JSONL
- Profile: Any besides
all-field-infoandall-field-info-verbose - Output: Terminal or CSV file
Required options:
-t, --timeline <JSONL-FILE-OR-DIR>: Hayabusa JSONL timeline file or directory of JSONL files
Options:
-l, --level: specify the minimum alert level (default:informational)-c, --sourceComputers: stack source computers instead of target computers (default: false)-o, --output <CSV-FILE>: the CSV file to save the results to (default:stdout)-q, --quiet: do not display logo. (default:false)-s, --skipProgressBar: do not display the progress bar (default:false)
stack-computers command examples¶
Output to terminal:
Save to CSV:
stack-dns command¶
This command will stack DNS queries and responses from Sysmon 22 events.
- Input: JSONL
- Profile: Any besides
all-field-infoandall-field-info-verbose - Output: Terminal or CSV file
Required options:
-t, --timeline <JSONL-FILE-OR-DIR>: Hayabusa JSONL timeline file or directory of JSONL files
Options:
-l, --level: specify the minimum alert level (default:informational)-o, --output <CSV-FILE>: the CSV file to save the results to (default:stdout)-q, --quiet: do not display logo. (default:false)-s, --skipProgressBar: do not display the progress bar (default:false)
stack-dns command examples¶
Output to terminal:
Save to CSV:
stack-ip-addresses command¶
This command will stack the target IP addresses (TgtIP field) or source IP addresses (SrcIP field).
- Input: JSONL
- Profile: Any besides
all-field-infoandall-field-info-verbose - Output: Terminal or CSV file
Required options:
-t, --timeline <JSONL-FILE-OR-DIR>: Hayabusa JSONL timeline file or directory of JSONL files
Options:
-l, --level: specify the minimum alert level (default:informational)-a, --targetIpAddresses: stack target IP addresses instead of source IP addresses (default:false)-o, --output <CSV-FILE>: the CSV file to save the results to (default:stdout)-q, --quiet: do not display logo. (default:false)-s, --skipProgressBar: do not display the progress bar (default:false)
stack-ip-addresses command examples¶
Output to terminal:
Save to CSV:
stack-logons command¶
Creates a list logons according to Target User, Target Computer, Logon Type, Source IP Address, Source Computer.
Results are filtered out when the source IP address is a local IP address by default.
- Input: JSONL
- Profile: Any besides
all-field-infoandall-field-info-verbose - Output: Terminal or CSV file
Required options:
-t, --timeline <JSONL-FILE-OR-DIR>: Hayabusa JSONL timeline file or directory of JSONL files
Options:
-l, --localSrcIpAddresses: include results when the source IP address is local.-o, --output <CSV-FILE>: the CSV file to save the results to (default:stdout)-q, --quiet: do not display logo. (default:false)-s, --skipProgressBar: do not display the progress bar (default:false)
stack-logons command examples¶
Run with default settings:
Include local logons:
stack-processes command¶
This command will stack executed processes from Sysmon 1 and Security 4688 events.
- Input: JSONL
- Profile: Any besides
all-field-infoandall-field-info-verbose - Output: Terminal or CSV file
Required options:
-t, --timeline <JSONL-FILE-OR-DIR>: Hayabusa JSONL timeline file or directory of JSONL files
Options:
-l, --level: specify the minimum alert level (default:low)-y, --ignoreSysmon: exclude Sysmon 1 events (default:false)-e, --ignoreSecurity: exclude Security 4688 events (default:false)-o, --output <CSV-FILE>: the CSV file to save the results to (default:stdout)-q, --quiet: do not display logo. (default:false)-s, --skipProgressBar: do not display the progress bar (default:false)
stack-processes command examples¶
Output to terminal:
Save to CSV:
stack-services command¶
This command will stack service names and paths from System 7040 and Security 4697 events.
- Input: JSONL
- Profile: Any besides
all-field-infoandall-field-info-verbose - Output: Terminal or CSV file
Required options:
-t, --timeline <JSONL-FILE-OR-DIR>: Hayabusa JSONL timeline file or directory of JSONL files
Options:
-l, --level: specify the minimum alert level (default:informational)-y, --ignoreSystem: exclude System 7040 events (default:false)-e, --ignoreSecurity: exclude Security 4697 events (default:false)-o, --output <CSV-FILE>: the CSV file to save the results to (default:stdout)-q, --quiet: do not display logo. (default:false)-s, --skipProgressBar: do not display the progress bar (default:false)
stack-services command examples¶
Output to terminal:
Save to CSV:
stack-tasks command¶
This command will stack new scheduled tasks from Security 4698 events and parse out the XML task content.
- Input: JSONL
- Profile: Any besides
all-field-infoandall-field-info-verbose - Output: Terminal or CSV file
Required options:
-t, --timeline <JSONL-FILE-OR-DIR>: Hayabusa JSONL timeline file or directory of JSONL files
Options:
-l, --level: specify the minimum alert level (default:informational)-o, --output <CSV-FILE>: the CSV file to save the results to (default:stdout)-q, --quiet: do not display logo. (default:false)-s, --skipProgressBar: do not display the progress bar (default:false)
stack-tasks command examples¶
Output to terminal:
Save to CSV:
stack-users command¶
This command will stack the target users (TgtUser field (default)) or source users (SrcUser field) in any event that has those fields as well as show alert information.
- Input: JSONL
- Profile: Any besides
all-field-infoandall-field-info-verbose - Output: Terminal or CSV file
Required options:
-t, --timeline <JSONL-FILE-OR-DIR>: Hayabusa JSONL timeline file or directory of JSONL files
Options:
-s, --sourceUsers: stack source users instead of target users (default: false)-c, --filterComputerAccounts: filter out computer accounts (default: true)-f, --filterSystemAccounts: filter out system accounts (default: true)-l, --level: specify the minimum alert level (default:informational)-o, --output <CSV-FILE>: the CSV file to save the results to (default:stdout)-q, --quiet: do not display logo. (default:false)-s, --skipProgressBar: do not display the progress bar (default:false)
stack-users command examples¶
Output to terminal:
Save to CSV: