Chainsaw

Overview

Chainsaw rapidly hunts through Windows event logs (.evtx files) for attacker TTPs. It maps findings to MITRE ATT&CK, supports Sigma rules for detection, and produces clear output for incident response triage. Essential for post-incident log analysis and CTF forensics challenges.

Basic Usage

Hunt for common attacker TTPs in event logs

chainsaw hunt /path/to/logs/ -s /opt/sigma-rules/ --mapping mappings/sigma-event-logs-all.yml

Analyse a single evtx file

chainsaw search -e "4688" /path/to/Security.evtx

Search all logs in a directory

chainsaw search -e "4624" /path/to/logs/

Dump all events from a log file

chainsaw dump /path/to/Security.evtx

Hunting with Sigma Rules

Clone Sigma rules

git clone https://github.com/SigmaHQ/sigma /opt/sigma-rules

Hunt with Sigma rules against Windows event logs

chainsaw hunt /path/to/logs/ \
  -s /opt/sigma-rules/rules/ \
  --mapping mappings/sigma-event-logs-all.yml \
  --output results.csv

Hunt with specific rule file

chainsaw hunt /path/to/logs/ \
  -s /opt/sigma-rules/rules/windows/process_creation/ \
  --mapping mappings/sigma-event-logs-all.yml

JSON output

chainsaw hunt /path/to/logs/ -s /opt/sigma-rules/ \
  --mapping mappings/sigma-event-logs-all.yml \
  --format json > results.json

Searching Event Logs

chainsaw search -e 4688 /path/to/logs/     # Process creation

chainsaw search -e 4624 /path/to/logs/     # Successful logon

chainsaw search -e 4625 /path/to/logs/     # Failed logon

chainsaw search -e 4648 /path/to/logs/     # Logon with explicit creds

chainsaw search -e 4698 /path/to/logs/     # Scheduled task created

chainsaw search -e 7045 /path/to/logs/     # New service installed

# Search by keyword
chainsaw search -s "powershell" /path/to/logs/
chainsaw search -s "mimikatz" /path/to/logs/
chainsaw search -s "net user" /path/to/logs/

Regex search

chainsaw search -r "cmd\.exe.*\/c.*whoami" /path/to/logs/

Search within time range

chainsaw search -e 4688 --from "2024-01-01T00:00:00" --to "2024-01-02T00:00:00" /path/

Case-insensitive search

chainsaw search -s "POWERSHELL" -i /path/to/logs/

Key Event IDs for Investigation

Output Formats

Default (human-readable table)

chainsaw hunt /path/to/logs/ -s sigma/ --mapping mappings.yml

CSV output

chainsaw hunt /path/to/logs/ -s sigma/ --mapping mappings.yml --output results.csv

JSON output

chainsaw hunt /path/to/logs/ -s sigma/ --mapping mappings.yml --format json

MITRE ATT&CK summary

chainsaw hunt /path/to/logs/ -s sigma/ --mapping mappings.yml --mitre-attck

Tips

• Start with chainsaw hunt + Sigma rules — it does the heavy lifting automatically
• Event ID 4688 requires “Audit Process Creation” to be enabled — not always present
• PowerShell logs (4104 Script Block Logging) are gold for detecting encoded/obfuscated commands
• On CTF forensics, mount the Windows disk image first, then point chainsaw at the Windows/System32/winevt/Logs/ directory

chainsaw [subcommand] [options]

Subcommands:
  hunt      Hunt for attacker TTPs (with Sigma rules)
  search    Search events by ID, keyword, or regex
  dump      Dump all events from a log file
  analyse   Analyse event log patterns
  lint      Validate Sigma rules

hunt options:
  -s PATH           Sigma rules directory
  --mapping FILE    Sigma field mapping file
  --output FILE     Output CSV file
  --format FORMAT   json, csv, table
  --from DATETIME   Start time filter
  --to DATETIME     End time filter
  --mitre-attck     Show ATT&CK mapping

search options:
  -e EVENTID        Filter by Event ID
  -s STRING         Search for string
  -r REGEX          Search with regex
  -i                Case-insensitive
  --from/--to       Time range

Vue d’ensemble

Chainsaw traque rapidement les TTP d’attaquants dans les journaux d’événements Windows (fichiers .evtx). Il mappe les découvertes sur MITRE ATT&CK, supporte les règles Sigma pour la détection, et produit une sortie claire pour le triage en réponse à incident. Indispensable pour l’analyse post-incident des journaux et les challenges de forensique en CTF.

Utilisation de base

# Traquer les TTP d'attaquants courants dans les journaux d'événements
chainsaw hunt /path/to/logs/ -s /opt/sigma-rules/ --mapping mappings/sigma-event-logs-all.yml

# Analyser un seul fichier evtx
chainsaw search -e "4688" /path/to/Security.evtx

# Chercher dans tous les journaux d'un répertoire
chainsaw search -e "4624" /path/to/logs/

# Dumper tous les événements d'un fichier journal
chainsaw dump /path/to/Security.evtx

Traque avec des règles Sigma

# Cloner les règles Sigma
git clone https://github.com/SigmaHQ/sigma /opt/sigma-rules

# Traquer avec les règles Sigma contre les journaux d'événements Windows
chainsaw hunt /path/to/logs/ \
  -s /opt/sigma-rules/rules/ \
  --mapping mappings/sigma-event-logs-all.yml \
  --output results.csv

# Traquer avec un fichier de règle précis
chainsaw hunt /path/to/logs/ \
  -s /opt/sigma-rules/rules/windows/process_creation/ \
  --mapping mappings/sigma-event-logs-all.yml

# Sortie JSON
chainsaw hunt /path/to/logs/ -s /opt/sigma-rules/ \
  --mapping mappings/sigma-event-logs-all.yml \
  --format json > results.json

Rechercher dans les journaux d’événements

chainsaw search -e 4688 /path/to/logs/     # Création de processus
chainsaw search -e 4624 /path/to/logs/     # Connexion réussie
chainsaw search -e 4625 /path/to/logs/     # Échec de connexion
chainsaw search -e 4648 /path/to/logs/     # Connexion avec identifiants explicites
chainsaw search -e 4698 /path/to/logs/     # Tâche planifiée créée
chainsaw search -e 7045 /path/to/logs/     # Nouveau service installé

# Recherche par mot-clé
chainsaw search -s "powershell" /path/to/logs/
chainsaw search -s "mimikatz" /path/to/logs/
chainsaw search -s "net user" /path/to/logs/

# Recherche par regex
chainsaw search -r "cmd\.exe.*\/c.*whoami" /path/to/logs/

# Recherche dans une plage de temps
chainsaw search -e 4688 --from "2024-01-01T00:00:00" --to "2024-01-02T00:00:00" /path/

# Recherche insensible à la casse
chainsaw search -s "POWERSHELL" -i /path/to/logs/

Event IDs clés pour l’investigation

Formats de sortie

# Par défaut (table lisible par un humain)
chainsaw hunt /path/to/logs/ -s sigma/ --mapping mappings.yml

# Sortie CSV
chainsaw hunt /path/to/logs/ -s sigma/ --mapping mappings.yml --output results.csv

# Sortie JSON
chainsaw hunt /path/to/logs/ -s sigma/ --mapping mappings.yml --format json

# Résumé MITRE ATT&CK
chainsaw hunt /path/to/logs/ -s sigma/ --mapping mappings.yml --mitre-attck

Conseils

• Commencez par chainsaw hunt + les règles Sigma : il fait le gros du travail automatiquement
• L’Event ID 4688 nécessite l’activation de “Audit Process Creation” : pas toujours présent
• Les journaux PowerShell (4104 Script Block Logging) sont en or pour détecter les commandes encodées/obfusquées
• En forensique CTF, montez d’abord l’image disque Windows, puis pointez chainsaw vers le répertoire Windows/System32/winevt/Logs/

chainsaw [subcommand] [options]

Subcommands:
  hunt      Hunt for attacker TTPs (with Sigma rules)
  search    Search events by ID, keyword, or regex
  dump      Dump all events from a log file
  analyse   Analyse event log patterns
  lint      Validate Sigma rules

hunt options:
  -s PATH           Sigma rules directory
  --mapping FILE    Sigma field mapping file
  --output FILE     Output CSV file
  --format FORMAT   json, csv, table
  --from DATETIME   Start time filter
  --to DATETIME     End time filter
  --mitre-attck     Show ATT&CK mapping

search options:
  -e EVENTID        Filter by Event ID
  -s STRING         Search for string
  -r REGEX          Search with regex
  -i                Case-insensitive
  --from/--to       Time range