Tools · Triage collection and timelines · 03 / 04
Chainsaw: search and hunt Windows event logs from a triage copy
Point Chainsaw at EVTX files from a triage collection, run its built-in rules and Sigma rules with a field mapping, and search for specific event IDs to confirm what a detection claimed.
Fast answers from raw EVTX
Chainsaw reads .evtx files directly, so an analyst can work on the event logs from a KAPE collection without loading them into a SIEM. hunt applies detection rules; search finds strings, regular expressions, or field values. It is a single binary and runs on Windows, Linux, and macOS.
Hunting with Sigma rules
Sigma rules use generic field names; the mapping file tells Chainsaw where those fields live in Windows event XML. Without --mapping, Sigma rules cannot be applied. Chainsaw’s own rules folder covers log clearing, new services, and other high-value events.
chainsaw hunt /cases/HB-114/WS-07/evtx/ \ -s /opt/sigma/rules/windows/ \ --mapping /opt/chainsaw/mappings/sigma-event-logs-all.yml \ -r /opt/chainsaw/rules/ \ --from 2026-10-28T08:00:00 --to 2026-10-28T12:00:00 \ --csv --output /cases/HB-114/WS-07/chainsaw/
What a hit looks like
Terminal output groups hits by rule group with a timestamp, the rule title, the computer, and key fields. The CSV output keeps the same columns per group for the case file.
[+] Group: Sigma timestamp detections computer Image CommandLine 2026-10-28 09:12:44 Suspicious PowerShell Download Cradle WS-07.lab C:\...\powershell.exe powershell -nop -w hidden -f C:\Users\Public\u.ps1 [+] Group: Service Installation 2026-10-28 09:14:10 New Service Installed WS-07.lab service: OneDriveSyncHelper path: C:\Users\Public\u.exe
Worked confirmation with search
The service hit is the claim to check. A search for event ID 7045 in the System log returns the full event: service name, image path, account, and start type. A second search for 4697 in the Security log, if auditing was on, shows which account installed it. Those two events, not the rule title, go into the report.
chainsaw search -t 'Event.System.EventID: =7045' /cases/HB-114/WS-07/evtx/System.evtx --json chainsaw search -t 'Event.System.EventID: =4697' /cases/HB-114/WS-07/evtx/Security.evtx chainsaw search -i 'u.exe' /cases/HB-114/WS-07/evtx/
Diagram
hunt versus search
One proposes leads; the other checks them.
Input. Rules plus a field mapping
Output. Detections grouped by rule
Use for. Finding what to look at
Input. A string, regex, or field expression
Output. The matching raw events
Use for. Confirming exactly what happened
Check yourself
1. Why does chainsaw hunt need --mapping when given Sigma rules?
2. Which Windows event ID records a new service installed, in the System log?
3. A rule title says “New Service Installed”. What belongs in the report?