Chainsaw

It's not really news that all the important events your machine happens to go through are added to what is called the Windows Event Logs. Here, you can find threats that your machine might have encountered and more, but what happens if you're looking for something specific, something that maybe happened days ago? Well, you'd be smart to use Chainsaw, especially if you don't have much time at hand.

The application itself doesn't really have an interface. In fact, it uses CMD to communicate with the user. Make sure you add the path to a CMD session in which you assume the role of the administrator. The app itself will allow any knowledgeable user to search and extract event logs by using various search algorithms and based on event ID, string matching, and regex pattern.

One can hunt threats using specific detection rules called Sigma. This is a built-in feature for this app and lies at its function core. Document tagging is supported and as far as output materials are concerned, you will be able to export in ASCII, CSV, and JSON format. Make sure you know exactly what format you need before launching any action.

Although CMD-based, the app does seem easy to understand. A command execution example is also provided, so you won't have any issues understanding how to launch any action. There are four main commands, Check, Help, Hunt and Search, with only three of them actually being used together with the Windows Event Log. As far as the speed of execution is concerned, the application delivers results quite fast, so you won't spend a lot of time waiting to receive the information you are seeking.

Chainsaw is an application that won't interest a lot of individuals. It requires some knowledge to operate, especially since it deals with sensitive operating system files. One wrong move could end up messing your whole OS. For the few that will indeed use the app, the provided functions are helpful and easy to access.