Event Log Chainsaw Massacre - Powerful Threat Detection

[@yannickleroy7419]

Not sure why this was in my recommended, but it was actually quite interesting. Thank's for showcasing this, subbed!

[@castle228]

Going to have to add this tool to the repertoire

[@mallikab8707]

Awesome 👌 Thank for your time and I will explore more on this.

[@rogerioabreu3081]

awesome. thnx

[@lonegunmen1985]

Awsome! Thanks for sharing the knowlege

[@NetworkITguy]

This with velociraptor is gg

[@sulthansk6444]

@Lordyzagat velociraptor ir tool

[@orlandop4sun]

Great job on this video.. súper profesional

[@adrianguerrero9583]

can you also do a preview/walkthrough for the Hayabusa tool by Yamato-Security. it looks like they are almost the same.

[@shadisukkar]

Hello 13Cubed. Thank you for this amazing video. I have a couple of questions regarding Chainsaw. Does Chainsaw work with Windows logs only, or does it work with other OS logs? Also, can it take (.json) logs or plain text logs (.log) as an input? Or is it specific for .evtx logs only?

[@13Cubed]

It's a cross-platform tool, but it's designed for Windows forensic artifacts. And yes, Chainsaw v2 introduces "support for loading and parsing Event Logs in both JSON and XML format."

[@shadisukkar]

@@13Cubed Thank you.

[@samjohn1098]

Pretty cool.. Nice

[@benw4529]

What happen to the syntax the commands to not work

[@amirhosseinhemmati9290]

can you please provide a link to log database that you used

[@13Cubed]

Hi, unfortunately that test database has been long since removed.

[@otvs5838]

Please share the Latest and safest source link to download chainsaw .

[@13Cubed]

github.com/WithSecureLabs/chainsaw/releases

[@artember1200]

does this require sysmon to be effective?

[@13Cubed]

No, but Sysmon is certainly highly beneficial.

[@Revoc]

This seems to be out of date now with their update.

[@13Cubed]

Such is life with KZbin... will consider making an update at some point.

[@ishannair1335]

none of these commands work for me. amazing

[@13Cubed]

What error do you receive when you try? I need a little more detail if you want to solve the issue.