Hayabusa vs OSForensics

Hayabusa is a free, open-source tool for Windows event log forensics and threat hunting. It processes EVTX logs from one host or thousands into CSV, JSON or JSONL timelines. Analysis features include computer and event ID metrics, logon summaries, keyword pivoting, HTML summary reports and MITRE ATT&CK mapping. It supports the Sigma specification, including v2 correlation rules; the project describes its curated detection rules as numbering over 4,000. The project says its multithreaded Rust implementation can deliver up to a 5x speed improvement and describes Rust as memory-safe. Hayabusa can run live on one system, process collected logs offline or hunt across endpoints through the Velociraptor Hayabusa artifact. Results can be imported into Elastic Stack, Timesketch and Timeline Explorer, while JSON can be analyzed with jq. Special Windows live-response packages bundle the program with encoded rules and configuration files to reduce files written to the system and help avoid antivirus false positives on YAML rule files. It runs on Windows, macOS and Linux, but no Linux ARM MUSL binary is provided because it does not run properly. The software uses AGPLv3; detection rules use DRL 1.1.

OSForensics is digital investigation software for extracting and examining forensic data from computers. It searches and indexes files, looks inside documents and email archives, and attempts to recover deleted files. Hashing can verify evidence or compare it with known files, while extension checks can flag files whose extensions are incorrect. The software can surface recent activity such as opened documents, web history, connected USB devices, and network shares. Password tools target commonly used web browsers and can use rainbow tables to retrieve passwords from hashes. Investigators can group evidence into case files, cryptographically hash data, and export reports readable as HTML or PDF, with narratives and external reports. It can maintain a secure audit trail and create or restore disk images for analysis. OSForensics can also run from a portable USB drive. Listed evidence sources include Windows, Mac, Linux, Android, and iOS/macOS file systems, plus disk images, memory dumps, email, browser data, registry hives, SQLite, and ESE databases. Windows 7, 8, 10, and 11 are listed, as are several Windows Server versions. A free license and a 30-day trial are listed; subscription pricing is $95 per user per month.