What it does
Chainsaw searches Windows event logs and other forensic artifacts using patterns, Sigma rules and custom detections, with several output formats.
Chainsaw combines text and regular-expression searches with detection-rule hunting. Its README also describes artifact-specific work such as execution timelines and SRUM analysis, useful when a responder needs more than a single keyword search. Choose the artifact that can answer the case question before running a broad hunt. Preserve the original record behind a match and export results in a format the next investigator can use. A detection rule narrows review; it does not establish malicious intent by itself.
Strengths
- Pattern searches and rule-based hunting
- Several Windows artifact-analysis workflows
Best for
- Responders conducting a first review of Windows evidence
Sources
- Features (Oct 26, 2026)