WithSecureLabs/chainsaw

Health v2 · maintenance only

Adoption not part of the score

3648 stars · 303 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Chainsaw is a Rust-based CLI tool for rapidly searching and hunting through Windows forensic artefacts such as Event Logs, MFT, and registry hives. It supports Sigma detection rules and custom detection logic to identify threats during incident response.

Use cases

• hunt for threats in Windows event logs using Sigma rules
• search forensic artefacts for keywords and regex patterns
• build execution timelines from Shimcache and Amcache
• analyse SRUM database usage data
• dump raw content of MFT and registry hives
• first-response triage during incident response

When to choose

• you need fast offline analysis of Windows event logs and forensic artefacts
• you want Sigma rule support in a lightweight CLI without a SIEM
• you're doing DFIR first-response on an endpoint without EDR coverage

When to avoid

• you need continuous real-time endpoint monitoring or EDR capabilities
• you require centralized log aggregation across a fleet of machines
• you need non-Windows forensic artefact support

Facets

cli-tool · maturity active

search-engine security parser cli security developer-tools windows cli rust dfir threat-hunting forensics sigma-rules event-logs incident-response blueteam mft shimcache srum command-line linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="WithSecureLabs/chainsaw")