Chainsaw

<div align="center"> <p> <h1> Rapidly Search and Hunt through Windows Forensic Artefacts </h1> </p> <img style="padding:0;vertical-align:bottom;" height="76" width="300" src="images/chainsaw.png"/> </div>

---

Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows forensic artefacts such as Event Logs and the MFT file. Chainsaw offers a generic and fast method of searching through event logs for keywords, and by identifying threats using built-in support for Sigma detection rules, and via custom Chainsaw detection rules.

Features

• :dart: Hunt for threats using Sigma detection rules and custom Chainsaw detection rules
• :mag: Search and extract forensic artefacts by string matching, and regex patterns
• :date: Create execution timelines by analysing Shimcache artefacts and enriching them with Amcache data
• :bulb: Analyse the SRUM database and provide insights about it
• :arrow_down: Dump the raw content of forensic artefacts (MFT, registry hives, ESE databases)
• :zap: Lightning fast, written in rust, wrapping the EVTX parser library by @OBenamram
• :feather: Clean and lightweight execution and output formats without unnecessary bloat
• :fire: Document tagging (detection logic matching) provided by the TAU Engine Library
• :bookmark_tabs: Output results in a variety of formats, such as ASCII table format, CSV format, and JSON format
• :computer: Can be run on MacOS, Linux and Windows

---

Table Of Contents

• Features
• Why Chainsaw?
• Hunting Logic for Windows Event Logs
• Quick Start Guide
  • Downloading and Running
  • Install/Build with Nix
  • EDR and AV Warnings
  • What changed in Chainsaw v2
• Examples
  • Searching
  • Hunting
  • Analysis
    • Shimcache
    • SRUM (System Resource Usage Monitor)
  • Dumping
• Acknowledgements

Extended information can be found in the Wiki for this tool: https://github.com/WithSecureLabs/chainsaw/wiki

Why Chainsaw?

At WithSecure Countercept, we ingest a wide range of telemetry sources from endpoints via our EDR agent to provide our managed detection and response service. However, there are circumstances where we need to quickly analyse forensic artefacts that hasn’t been captured by our EDR, a common example being incident response investigations on an estate where our EDR wasn’t installed at the time of the compromise. Chainsaw was created to provide our threat hunters and incident response consultants with a tool to perform rapid triage of forensic artefacts in these circumstances.

Windows Event Logs

Windows event logs provide a rich source of forensic information for threat hunting and incident response investigations. Unfortunately, processing and searching through event logs can be a slow and time-consuming process, and in most cases requires the overhead of surrounding infrastructure – such as an ELK stack or Splunk instance – to hunt efficiently through the log data and apply detection logic. This overhead often means that blue teams are unable to quickly triage Windows event logs to provide the direction and conclusions required to progress their investigations. Chainsaw solves the issue since it allows the rapid search and hunt through Windows event logs.

At the time of writing, there are very few open-source, standalone tools that provide a simple and fast method of triaging Windows event logs, identifying interesting elements within the logs and applying a detection logic rule format (such as Sigma) to detect signs of malicious activity. In our testing, the tools that did exist struggled to efficiently apply detection logic to large volumes of event logs making them unsuitable for scenarios where quick triage is required.

Hunting Logic for Windows Event Logs

Sigma Rule Matching

Using the --sigma and --mapping parameters you can specify a directory containing a subset of SIGMA detection rules (or just the entire SIGMA git repo) and chainsaw will automatically load, convert and run these rules against the provided event logs. The mapping file tells chainsaw which fields in the event logs to use for rule matching. By default, Chainsaw supports a wide range of Event Log types, including but not limited to:

|Event Type|Event ID | |--|--| |Process Creation (Sysmon)| 1 | |Network Connections (Sysmon)|3| |Image Loads (Sysmon)|7| |File Creation (Sysmon)|11| |Registry Events (Sysmon)|13| |Powershell Script Blocks|4104| |Process Creation|4688| |Scheduled Task Creation|4698| |Service Creation|7045|

See the mapping file for the full list of fields that are used for rule detection, and feel free to extend it to your needs.

Chainsaw Detection Rules

In addition to supporting sigma rules, Chainsaw also supports a custom rule format. In the repository you will find a rules directory that contains various Chainsaw rules that allows users to:

1. Extract and parse Windows Defender, F-Secure, Sophos, and Kaspersky AV alerts
2. Detect key event logs being cleared, or the event log service being stopped
3. Users being created or added to sensitive user groups
4. Remote Logins (Service, RDP, Network etc.) events. This helps hunters to identify sources of lateral movement
5. Brute-force of local user accounts

Quick Start Guide

Downloading and Running

With the release of Chainsaw v2, we decided to no longer include the Sigma Rules and EVTX-Attack-Samples repositories as Chainsaw submodules. We recommend that you clone these repositories separately to ensure you have the latest versions.

If you still need an all-in-one package containing the Chainsaw binary, Sigma rules and example Event logs, you can download it from the releases section of this GitHub repo. In this releases section you will also find pre-compiled binary-only versions of Chainsaw for various platforms and architectures.

If you want to compile Chainsaw yourself, you can clone the Chainsaw repo:

git clone https://github.com/WithSecureLabs/chainsaw.git

and compile the code yourself by running: cargo build --release. Once the build has finished, you will find a copy of the compiled binary in the target/release folder.

Make sure to build with the --release flag as this will ensure significantly faster execution time.

If you want to quickly see what Chainsaw looks like when it runs, you can clone the Sigma Rules and EVTX-Attack-Samples repositories:

git clone https://github.com/SigmaHQ/sigma
git clone https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES.git

and then run Chainsaw with the parameters below:

./chainsaw hunt EVTX-ATTACK-SAMPLES/ -s sigma/ --mapping mappings/sigma-event-logs-all.yml

Install/build with Nix

├───devShells
│   └───x86_64-linux
│       └───default: development environment 'nix-shell'
├───formatter
│   └───x86_64-linux: package 'alejandra-3.1.0'
└───packages
    └───x86_64-linux
        ├───chainsaw: package 'chainsaw-2.10.1'
        └───default: package 'chainsaw-2.10.1'

Chainsaw, as a package, is available via nixpkgs. If you're using NixOS, just add chainsaw to your system configuration file.

However, if you're not using NixOS, you can still install Chainsaw via Nix. The recommend way is via nix-shell, which will temporarily modify your $PATH environment variable. To do so, please run the following:

nix-shell -p chainsaw

You can also utilize the fact, that this repo is a flake, and you can run the following:

nix profile install github:WithSecureLabs/chainsaw

However, if you want to build chainsaw yourself, using Nix, you can once again utilize flake.nix, which is provided with this repository. To build the binary, please run the following, in the root dir of cloned repo

nix build .#

This will create ./result directory, with chainsaw binary located under ./result/bin/chainsaw.

EDR and AV Warnings

When downloading and running chainsaw you may find that your local EDR / AntiVirus engine detects Chainsaw as malicious. You can see examples of this in the following GitHub issues: Example1, Example2.

These warnings are typically due to the example event logs and/or Sigma rules which contain references to malicious strings (e.g. "mimikatz"). We have also seen instances where the Chainsaw binary has been detected by a small subset of Anti-Virus engines likely due to some form of heuristics detection.

What changed in Chainsaw v2?

In July 2022 we released version 2 of Chainsaw which is a major overhaul of how Chainsaw operates. Chainsaw v2 contains several significant improvements, including the following list of highlights:

• An improved approach to mapping Sigma rules which results in a significant increase in the number of supported Chainsaw rules, and Event Log event types.
• Improved CLI output which shows a snapshot of all Event Data for event logs containing detections.
• Support for loading and parsing Event Logs in both JSON and XML format.
• Cleaner and simpler command line arguments for the Hunt and Search features.
• Additional optional output information, such as Rule Author, Rule Status, Rule Level etc.
• The ability to filter loaded rules by status, kind, and severit