hunting-evtx-with-chainsaw

name	hunting-evtx-with-chainsaw
description	Perform rapid Sigma and keyword hunting across Windows event logs with Chainsaw.
domain	cybersecurity
subdomain	threat-hunting
tags	["chainsaw","threat-hunting","evtx","sigma","windows-event-logs","dfir","detection","shimcache"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.AE-02"]
mitre_attack	["T1059.001"]

Hunting EVTX with Chainsaw

Overview

Chainsaw is a fast, Rust-based forensic artifact search and hunting tool from WithSecure Labs. It provides first-response capability to rapidly identify threats within Windows Event Logs (.evtx) and other artifacts. Chainsaw can hunt with the full SigmaHQ rule corpus (translating Sigma to its internal Tau engine), run its own built-in detection rules, perform high-speed keyword/regex search across logs, and analyse specialized artifacts such as the AppCompatCache (shimcache), SRUM database, and event-log gaps. Output can be a colorized table, CSV, or JSON for downstream tooling.

Chainsaw's strength is speed and flexibility during initial triage: an analyst can drop a folder of collected EVTX onto the tool and get back a prioritized set of detections in seconds, then pivot with targeted search queries to confirm a hypothesis. Unlike a SIEM, it needs no ingestion pipeline, runs as a single binary, and works fully offline against acquired evidence — ideal for the field or an air-gapped analysis VM. The --mapping file tells Chainsaw how Sigma fields translate to Windows event fields, which is what enables broad Sigma coverage over EVTX.

A common hunt outcome is detecting suspicious PowerShell — MITRE ATT&CK T1059.001 (Command and Scripting Interpreter: PowerShell) — by running Sigma rules against PowerShell operational logs (Event ID 4104 script-block logging) or searching for encoded-command patterns. This skill maps to NIST CSF DE.AE-02 (potentially adverse events are analyzed to better understand associated activities).

When to Use

• During first-response triage to rapidly hunt threats across collected Windows event logs.
• When you need offline Sigma-based detection over .evtx without standing up a SIEM.
• To run fast keyword/regex searches confirming or refuting a hunt hypothesis.
• To analyse shimcache, SRUM, or event-log time gaps for execution evidence and tampering.
• To produce CSV/JSON detection output for reporting or pipeline ingestion.

Prerequisites

• Chainsaw binary. Download a release from GitHub or build from source:

  # Build from source (Rust toolchain required)
  git clone https://github.com/WithSecureLabs/chainsaw.git
  cd chainsaw && cargo build --release
  ./target/release/chainsaw --version
  # or: nix profile install github:WithSecureLabs/chainsaw
  

• The Chainsaw repo ships mappings/ (Sigma field mappings) and rules/ (Chainsaw rules).
• A copy of the SigmaHQ rules for full Sigma coverage:

  git clone https://github.com/SigmaHQ/sigma.git
  

• Collected Windows .evtx files (and registry hives like SYSTEM/Amcache.hve for shimcache analysis).

Objectives

• Hunt collected EVTX with Sigma rules using the correct mapping file.
• Filter detections by rule level, status, and kind to reduce noise.
• Search logs by keyword, regex, and Tau expression for targeted confirmation.
• Output detections as table, CSV, and JSON.
• Analyse shimcache (with Amcache timestamp pairing), SRUM, and event-log gaps.

MITRE ATT&CK Mapping

Technique ID	Official Name	Why Chainsaw Detects It
T1059.001	Command and Scripting Interpreter: PowerShell	Sigma rules over EID 4104/4103 and search flag malicious PowerShell
T1059.003	Command and Scripting Interpreter: Windows Command Shell	Process-creation Sigma rules surface suspicious cmd usage
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Sigma rules over registry events flag persistence
T1053.005	Scheduled Task/Job: Scheduled Task	Rules over EID 4698/106 detect task creation
T1070.006	Indicator Removal: Timestomp	analyse gaps and shimcache analysis reveal tampering/time gaps
T1204.002	User Execution: Malicious File	Shimcache analysis shows executed binaries

Workflow

1. Hunt EVTX with Sigma rules

Run the SigmaHQ corpus against collected logs using the bundled mapping file. The mapping translates Sigma fields to EVTX fields.

chainsaw hunt ./collected_evtx \
  -s ./sigma/rules \
  --mapping ./mappings/sigma-event-logs-all.yml

2. Hunt with Chainsaw built-in rules plus Sigma

Combine Chainsaw's own rules (-r) with Sigma (-s) for broader coverage.

chainsaw hunt ./collected_evtx \
  -r ./rules \
  -s ./sigma/rules \
  --mapping ./mappings/sigma-event-logs-all.yml

3. Filter to reduce noise

Limit results by Sigma rule level, status, and detection kind.

chainsaw hunt ./collected_evtx -s ./sigma/rules \
  --mapping ./mappings/sigma-event-logs-all.yml \
  --level high --status stable --kind evtx

4. Output to CSV and JSON

Write structured output for reporting and pipelines.

# JSON to stdout/file
chainsaw hunt ./collected_evtx -s ./sigma/rules \
  --mapping ./mappings/sigma-event-logs-all.yml --json > detections.json

# CSV into a directory (one file per detection group)
chainsaw hunt ./collected_evtx -s ./sigma/rules \
  --mapping ./mappings/sigma-event-logs-all.yml --csv --output ./csv_out

5. Targeted keyword and regex search

Confirm a hypothesis by searching raw events independent of rules.

# Case-insensitive keyword search
chainsaw search "mimikatz" -i ./collected_evtx

# Regex for base64-encoded PowerShell commands, as JSON
chainsaw search -e "-[Ee]nc(odedCommand)?\s+[A-Za-z0-9+/=]{20,}" ./collected_evtx --json

# Time-bounded search using a Tau expression
chainsaw search ./collected_evtx -t 'Event.System.EventID: =4624' \
  --from "2026-06-01T00:00:00" --to "2026-06-20T00:00:00"

6. Analyse shimcache for execution evidence

Parse the AppCompatCache from the SYSTEM hive, pair it with Amcache timestamps, and pattern-match suspicious entries.

chainsaw analyse shimcache ./SYSTEM \
  --regexfile ./shimcache_patterns.txt \
  --amcache ./Amcache.hve --tspair \
  --output ./shimcache_analysis.csv

7. Analyse SRUM and event-log gaps

Detect program/network usage and identify suspicious logging gaps (possible log clearing or timestomp).

# SRUM database analysis
chainsaw analyse srum --software ./SOFTWARE ./SRUDB.dat -o srum.json

# Event-log gaps that may indicate cleared/tampered logs
chainsaw analyse gaps ./collected_evtx --min-time-gap-minutes 30 --json

8. Dump and lint

Inspect raw artifact content and validate custom rules before a hunt.

chainsaw dump ./SOFTWARE --json --output dump.json
chainsaw lint -r ./rules --kind sigma

Tools and Resources

Tool	Purpose	Source
Chainsaw	Fast EVTX/artifact hunting and search	https://github.com/WithSecureLabs/chainsaw
SigmaHQ rules	Community detection rules	https://github.com/SigmaHQ/sigma
Chainsaw mappings	Sigma-to-EVTX field mappings	https://github.com/WithSecureLabs/chainsaw/tree/master/mappings
Hayabusa	Alternative Sigma EVTX timeline tool	https://github.com/Yamato-Security/hayabusa
Timeline Explorer	Review CSV output	https://ericzimmerman.github.io/

Validation Criteria

• Chainsaw binary installed and --version confirmed.
• SigmaHQ rules and the correct mapping file available.
• Sigma hunt run against the collected EVTX directory.
• Chainsaw built-in rules combined with Sigma where appropriate.
• Detections filtered by level/status/kind to reduce noise.
• CSV and/or JSON output produced for reporting.
• Targeted keyword/regex/Tau searches run to confirm findings.
• Shimcache analysed with Amcache timestamp pairing.
• SRUM and event-log-gap analysis performed where artifacts exist.
• Findings (e.g., PowerShell T1059.001) documented for the hunt report.