Chainsaw is a Windows forensic analysis tool used for parsing system databases and extracting security artefacts. It functions as a forensic artefact extractor and a scanner for identifying security threats and log tampering within Windows event logs.
The project distinguishes itself by implementing a Sigma rule forensic scanner that applies standardized detection logic and custom rule sets to event logs and forensic artefacts. It enables threat hunting workflows by matching event data against patterns to identify malicious activity, lateral movement, and brute force attacks.
The tool's capabilities include event log triage using regular expressions, execution timeline reconstruction through the correlation of shimcache and amcache data, and the parsing of system resource usage databases. It further provides forensic data search utilities and the ability to export raw binary artefacts into structured JSON formats for external analysis.