Chainsaw
A fast, standalone tool for rapid threat hunting and forensic analysis of Windows event logs and other forensic artefacts.
What is Chainsaw?
Chainsaw is a fast, standalone command-line tool for rapid threat hunting and forensic analysis of Windows event logs and other forensic artefacts like the MFT and registry hives. It solves the problem of slow, infrastructure-heavy log analysis by enabling quick triage and detection of malicious activity directly on collected artefacts.
Incident responders, threat hunters, and digital forensics professionals who need to quickly analyze Windows forensic data during security investigations, especially in environments without existing EDR telemetry.
Developers choose Chainsaw for its exceptional speed, ease of use, and ability to apply sophisticated detection logic (like Sigma rules) without requiring a full SIEM or log management stack, making it ideal for rapid on-scene triage.
Overview
Rapidly Search and Hunt through Windows Forensic Artefacts
Use Cases
Best For
- Rapid triage of Windows event logs during incident response
- Applying Sigma detection rules to forensic artefacts without a SIEM
- Creating execution timelines from Shimcache and Amcache data
- Analyzing the SRUM database for system usage insights
- Searching and extracting data from MFT and registry hives
- Threat hunting across collected forensic artefacts in standalone scenarios
Not Ideal For
- Organizations requiring real-time, continuous monitoring and alerting from live systems
- Teams needing advanced data visualization or interactive dashboards for forensic analysis
- Scenarios focused solely on raw data extraction without applying detection logic or hunting
- Environments with fully integrated SIEM solutions like Splunk or ELK for long-term log management
Pros & Cons
Pros
Written in Rust and leveraging the EVTX parser library, Chainsaw executes lightning-fast searches and hunts through event logs, enabling rapid triage as highlighted in its philosophy of speed and simplicity.
Supports both Sigma detection rules and custom Chainsaw rules, allowing threat hunters to apply a wide range of detection logic without needing a SIEM, with built-in support for event types like Sysmon and PowerShell.
Includes specialized analysis for Shimcache with Amcache enrichment, SRUM database parsing, and artefact dumping (e.g., MFT, registry hives), providing multi-faceted insights from Windows forensic artefacts.
Runs on macOS, Linux, and Windows, as stated in the README, ensuring it can be deployed in diverse operating environments during incident response.
Cons
Requires separate cloning of Sigma rules and EVTX samples repositories for full functionality, adding setup complexity compared to all-in-one packages, as noted in the 'Downloading and Running' section.
Known to trigger EDR and AV warnings due to malicious strings in example data or heuristics detection, potentially hindering deployment in secure environments, with examples linked in GitHub issues.
Lacks a graphical user interface, relying solely on CLI commands, which may be less accessible for users accustomed to visual tools or automated workflows.
Frequently Asked Questions
Related Projects
SigmaMain Sigma Rule Repository
HayabusaHayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
LogonTracerInvestigate malicious Windows logon by visualizing and analyzing Windows event log
StreamAlertStreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.