chainsaw is a Rust-based DFIR utility that lets authorized incident responders and threat hunters rapidly search Windows EVTX logs, the MFT, and registry artefacts using Sigma rules and regex patterns.
| Tool | WithSecureOpenSource/chainsaw — a fast first-response tool for searching and hunting threats in Windows forensic artefacts such as Event Logs and the MFT |
| Category | Digital forensics and incident response (DFIR), threat hunting, detection engineering |
| Primary Use | Rapid triage of EVTX event logs and MFT data during incident response, applying Sigma and custom detection rules plus string/regex searching without a Splunk or ELK stack |
| Safe Use | Designed for authorized incident response investigations, managed detection and response engagements, and lab-based forensic training on artefacts you own or are contracted to analyze |
| Telemetry Note | Purely defensive and read-only: chainsaw parses offline artefacts and touches no remote systems, but defenders should note that its binary and bundled rule sets sometimes trigger EDR/AV heuristic detections due to embedded strings like mimikatz in sample rules |
chainsaw is a Rust tool from WithSecure's Countercept team that answers a very specific operational pain point: when an incident responder lands on a compromised estate where no EDR agent was deployed at the time of the compromise, the only telemetry left is the raw Windows forensic artefacts — EVTX event logs, the MFT, registry hives — and those are notoriously slow to triage without surrounding infrastructure. The README is candid about the origin: WithSecure's managed detection and response consultants needed something to do rapid triage on artefacts their EDR never captured, and chainsaw is the productised answer. It bills itself as a 'first-response' capability, which positions it squarely as a triage tool rather than a full forensic suite.
The performance story is the headline architectural fact. chainsaw is written in Rust and wraps the evtx parser library by @OBenamram, which is one of the fastest standalone Windows event log parsers available. The README explicitly frames the alternative as standing up an ELK stack or Splunk instance just to hunt through a folder of logs, an overhead that delays conclusions blue teams need quickly. It also notes that the few competing open-source standalone tools that existed struggled to apply detection logic efficiently at volume, which is the gap chainsaw was built to close. The --release build flag is explicitly recommended because it significantly improves execution time — a practical detail that tells you the authors benchmark this thing seriously.
Detection logic comes in two flavours. The first is native Sigma support: pass a directory of rules via --sigma and a field mapping via --mapping, and chainsaw will load, convert, and run them against the supplied event logs. The mapping file translates Sigma field names into the actual fields present in Windows event records, and the default mappings cover the high-value event types you would expect: Sysmon 1 process creation, 3 network connections, 7 image loads, 11 file creation, and 13 registry events, plus classic events like 4688 process creation, 4698 scheduled task creation, 7045 service creation, and 4104 PowerShell script block logging. The mapping file is user-extensible, so detection engineers can wire in additional log sources as needed.
The second flavour is the custom chainsaw rule format, and the bundled rules directory is where the tool's incident-response DNA shows most clearly. The shipped rules extract and parse AV alerts from Windows Defender, F-Secure, Sophos, and Kaspersky; detect key event logs being cleared or the event log service being stopped — classic anti-forensics tells; flag user creation or additions to sensitive groups; surface remote login events across service, RDP, and network logon types to help identify lateral movement sources; and detect brute-force patterns against local accounts. This is attacker-behaviour-centric detection written by people who do this for a living, and it means the tool delivers value before you configure anything.
Beyond search and hunt, chainsaw has a genuine analysis mode. It can build execution timelines by parsing Shimcache artefacts and enriching them with Amcache data — a pairing every responder knows is far more useful together than either hive alone, since Amcache supplies path and timestamp context for the bare Shimcache execution entries. It can also analyze the SRUM database for system resource usage insights, perform event log gap detection to spot suspicious holes in the record, and dump raw content from MFT records, registry hives, and ESE databases for follow-up in other tooling. That dump capability makes it a reasonable front door to a wider forensic workflow.
The search subcommand is a lean grep-on-steroids for artefacts: it accepts string and regex patterns via -e/--regex, supports --ignore-case, time-bounded searching with --from, extension filtering via --extension, tolerant behaviour with --skip-errors and --load-unknown, and multiple output formats. Results can be emitted as ASCII tables for terminal work, CSV for spreadsheets, or JSON for pipelining into other tooling. Document tagging — the actual matching of detection logic against parsed records — is delegated to the TAU Engine library, also from WithSecure Labs, which is the component that does the heavy lifting of evaluating rule conditions against the normalised event data.
Getting started is straightforward and there are several installation paths. Beyond git clone plus cargo build --release, pre-compiled binaries ship for various platforms and architectures in the GitHub releases, and the tool is packaged in nixpkgs, installable with nix-shell -p chainsaw or nix profile install github:WithSecureLabs/chainsaw — the repo is also a flake, so nix build .# works for local builds. Since v2, the Sigma rules and EVTX-Attack-Samples repositories are no longer submodules; the authors recommend cloning SigmaHQ/sigma and sbousseaden/EVTX-ATTACK-SAMPLES separately to guarantee current rule content. A representative hunt against the sample corpus looks like ./chainsaw hunt EVTX-ATTACK-SAMPLES/ -s sigma/ --mapping mappings/sigma-event-logs-all.yml. Cross-platform support covers macOS, Linux, and Windows, which matters for responders who triage from whatever box they have handy.
Version 2, released in July 2022, was a ground-up overhaul and is the only maintained line — v1 lives on in the v1.x.x branch and the README explicitly tells remaining users to migrate. The v2 highlights read like a maturity checklist: a rewritten Sigma mapping approach that significantly increased the number of supported rules and event types, support for loading event logs in both JSON and XML formats, cleaner CLI arguments for hunt and search, optional output metadata such as Rule Author, Rule Status, and Rule Level, rule filtering by status, kind, and severity, and a code rewrite aimed at readability and lowering the barrier for community contributions. Credit goes to @AlexKornitzer for turning the v1 'Christmas Project' codebase into a polished product.
One operational caveat deserves attention before you deploy this in a customer environment: the README has a dedicated section on EDR and AV warnings. Because the bundled example event logs and Sigma rules contain references to malicious strings such as mimikatz, and because of heuristic detections against the binary itself in a small subset of engines, the tool can be flagged as malicious on arrival. There are public GitHub issues documenting this. If you are triaging inside a monitored environment, pre-stage chainsaw on your analysis workstation or an exclusion-approved VM rather than discovering this mid-engagement — and from a defensive perspective, it is worth knowing this tool exists on both sides: it is equally useful to a red teamer doing post-exploitation log review, so its presence in unexpected places on an endpoint may itself be an interesting signal.
In the broader tooling landscape, chainsaw occupies the space between heavyweight SIEM-dependent hunting and manual EvtxExplorer clicking. The GPL-3.0 license, roughly 3.6k stars, active maintenance, and the backing of a commercial MDR practice all speak to its real-world credibility. For authorized responders and threat hunters who need defensible answers from a folder of EVTX files in minutes rather than hours — with Sigma portability meaning your existing detection corpus carries over — it has earned its place in the standard DFIR kit, and the extended wiki on the repository is the right next stop for deeper operational detail.
WithSecureOpenSource/chainsaw.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.