domains / families / security / hunting-evtx-with-chainsaw

hunting-evtx-with-chainsaw

separate

Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword/regex search, plus analyze shimcache, SRUM, and event-log gaps, outputting colorized tables, CSV, or JSON. Use during first-response triage for offline, SIEM-free detection over Windows event logs, or to quickly confirm a hunt hypothesis and produce reporting output.

When to use

• During first-response triage to rapidly hunt threats across collected Windows event logs.
• When you need offline Sigma-based detection over `.evtx` without standing up a SIEM.
• To run fast keyword/regex searches confirming or refuting a hunt hypothesis.
• To analyse shimcache, SRUM, or event-log time gaps for execution evidence and tampering.
• To produce CSV/JSON detection output for reporting or pipeline ingestion.

Skill page

Source