Chainsaw
A fast, standalone tool for rapid threat hunting and forensic analysis of Windows event logs and other forensic artefacts.
What is Chainsaw?
Chainsaw is a fast, standalone command-line tool for rapid threat hunting and forensic analysis of Windows event logs and other forensic artefacts like the MFT and registry hives. It solves the problem of slow, infrastructure-heavy log analysis by enabling quick triage and detection of malicious activity directly on collected artefacts.
Incident responders, threat hunters, and digital forensics professionals who need to quickly analyze Windows forensic data during security investigations, especially in environments without existing EDR telemetry.
Developers choose Chainsaw for its exceptional speed, ease of use, and ability to apply sophisticated detection logic (like Sigma rules) without requiring a full SIEM or log management stack, making it ideal for rapid on-scene triage.
Overview
Rapidly Search and Hunt through Windows Forensic Artefacts
Use Cases
Best For
- Rapid triage of Windows event logs during incident response
- Applying Sigma detection rules to forensic artefacts without a SIEM
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
