Event Log Chainsaw Massacre - Powerful Threat Detection

[@yannickleroy7419]

Not sure why this was in my recommended, but it was actually quite interesting. Thank's for showcasing this, subbed!

[@mallikab8707]

Awesome 👌 Thank for your time and I will explore more on this.

[@castle228]

Going to have to add this tool to the repertoire

[@lonegunmen85]

Awsome! Thanks for sharing the knowlege

[@orlandop4sun]

Great job on this video.. súper profesional

[@rogerioabreu3081]

awesome. thnx

[@adrianguerrero9583]

can you also do a preview/walkthrough for the Hayabusa tool by Yamato-Security. it looks like they are almost the same.

[@NetworkITguy]

This with velociraptor is gg

[@sulthansk6444]

@Lordyzagat velociraptor ir tool

[@shadisukkar]

Hello 13Cubed. Thank you for this amazing video. I have a couple of questions regarding Chainsaw. Does Chainsaw work with Windows logs only, or does it work with other OS logs? Also, can it take (.json) logs or plain text logs (.log) as an input? Or is it specific for .evtx logs only?

[@13Cubed]

It's a cross-platform tool, but it's designed for Windows forensic artifacts. And yes, Chainsaw v2 introduces "support for loading and parsing Event Logs in both JSON and XML format."

[@shadisukkar]

@@13Cubed Thank you.

[@amirhosseinhemmati9290]

can you please provide a link to log database that you used

[@13Cubed]

Hi, unfortunately that test database has been long since removed.

[@samjohn1098]

Pretty cool.. Nice

[@benw4529]

What happen to the syntax the commands to not work

[@otvs5838]

Please share the Latest and safest source link to download chainsaw .

[@13Cubed]

github.com/WithSecureLabs/chainsaw/releases

[@Revoc]

This seems to be out of date now with their update.

[@13Cubed]

Such is life with KZbin... will consider making an update at some point.

[@artember1200]

does this require sysmon to be effective?

[@13Cubed]

No, but Sysmon is certainly highly beneficial.

[@Niteshkumar223-c2u]

none of these commands work for me. amazing

[@13Cubed]

What error do you receive when you try? I need a little more detail if you want to solve the issue.