Chainsaw

binary

Rapid triage of Windows forensic artefacts, shipped with its Sigma-mapped ruleset.

Location

/usr/local/bin/chainsaw · rules in /opt/detectops/threat-hunting/chainsaw-rules/chainsaw

How to run

chainsaw hunt ./evtx_dir -s chainsaw-rules/chainsaw/sigma --mapping chainsaw-rules/chainsaw/mappings/sigma-event-logs-all.yml

---

Part of the Threat Hunting & Endpoint Analysis toolset in DetectOps.