Chainsaw

Chainsaw provides a powerful first-response capability for quickly identifying threats within Windows forensic artefacts such as Event Logs and MFT files. It offers a generic and fast method of searching through event logs for keywords and uses built-in support for Sigma detection rules along with custom Chainsaw detection rules.

Use cases include threat hunting in forensic investigations, rapid triage of event logs for indicators of compromise, and validating detection rules. It is particularly useful for security analysts and incident responders dealing with Windows environments.

The tool supports multiple commands for dumping artefacts, hunting threats, linting rules, searching patterns, and performing analyses, making it versatile for forensic workflows.

Chainsaw processes Windows forensic artefacts like EVTX event logs and MFT files using multi-threaded operations (defaulting to CPU count). It parses logs for keywords or patterns via the search command, applies Sigma rules with mappings for threat detection in hunt mode, and supports custom rules. Additional commands enable dumping to formats like JSON, rule linting, and artefact analysis.