Chainsaw is an open-source first-responder tool for quickly detecting threats in Windows forensic artifacts. It can be used in event logs and the MFT file.
It enables quick keyword searches in event logs and detects threats using built-in Sigma detection rules as well as custom detection rules.
Discover more articles in search results.
Chainsaw features
- Threat hunting using Sigma detection rules as well as custom detection rules
- Forensic search and extraction with string matching and regex patterns
- Build execution schedules by parsing Shimcache artifacts and enriching them with Amcache data
- Analyze the SRUM database and get the necessary information
- Dump of forensic raw content (MFT, registry hives, ESE databases)
- Fast, written in rust, contains the EVTX parser library
- Clean and lightweight execution and output formats without unnecessary bloat
- Document tagging provided by the TAU Engine Library
- Output results in a variety of formats including ASCII table format, CSV format and JSON format
Chainsaw is available free on GitHub. It can run on Linux, macOS and Windows.
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
