chainsaw
v2.17.1 open-sourceThe section your link pointed to isn't on chainsaw's page any more, so we've brought you to the top.
Chainsaw is a command-line tool that rapidly searches and hunts through Windows forensic artefacts such as Event Logs and the MFT file.
chainsaw summary <path> chainsaw analyze --timeline --input /path/to/shimcache --enrich-with /path/to/amcache chainsaw parse --type registry --input /path/to/system.hiv chainsaw dump events.evtx > output.json chainsaw hunt ./tests --jsonl > results.jsonl chainsaw hunt ./tests --threads 2 chainsaw analyze --input mft.dat chainsaw analyze --input system.evt
Summary
Chainsaw is an open-source command-line tool for rapidly searching and hunting through Windows forensic artefacts such as Event Logs, the MFT, and SRUM and Shimcache data, and it is free to use. It runs as a single binary on Windows, Linux, or macOS, matching events against Sigma detection rules or its own custom rule format and returning results as ASCII tables, CSV, or JSON, which makes it suited to DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems. practitioners and threat hunters doing first-response triage rather than long-form analysis. It sits alongside other Windows event log and artefact analysis tools built on Sigma rules, offering a lightweight command-line alternative to heavier forensic suites. Written in Rust and built on the evtx parser library, it has been active since 2021, with 29 contributors, 35 commits in the past year, and a release only 17 days ago.
Chainsaw is a command-line tool that rapidly searches and hunts through Windows forensic artefacts such as Event Logs and the MFT file.
How chainsaw helps
Which hosts in this incident actually show signs of compromise, before I read a single log by hand?
matches every event against Sigma and custom detection rules and returns only the hits, as a table, CSV, or JSON, instead of the full raw log
Did this attacker run something that looked like credential dumping?
string- and regex-matches event content for known-bad indicators such as mimikatz references or suspicious PowerShell script block text, and lists every hit with its source event
What ran on this machine that no longer exists as a file?
analyses Shimcache entries and enriches them with Amcache data to build an execution timeline, so program-run evidence survives even after deletion
What did a user or process actually do on this system, based on resource usage rather than the event log?
parses the SRUM database directly and reports the activity it recorded, filling gaps where Event Logs were cleared or disabled
Is there a hole in this system's Event Log history that would hide an attacker's actions?
checks for gaps in the log timeline and flags the missing windows so an investigator knows where the record cannot be trusted
What am I actually looking at before I commit to a full hunt across this artefact?
summarises an EVTX file's contents at a glance so a responder can judge relevance before running detection rules against it
Languages
Command line
No command matches.
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
- Community health
-
Contributor trend distinct committers, this year against last
-
Maintainer concentration bus factor now against a year ago
-
Issue backlog trend issues closed per issue opened, 12 months
-
Responsiveness median time to a maintainer’s first reply
Nine scores for chainsaw, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail chainsaw puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Coverage
Missing something? Tell us
What chainsaw connects to, runs on and detects, read from its release notes and docs. So far: 1 new detection.
1 change, tracked since Oct 14, 2026.
-
Oct 142026
new Sigma windash modifier support
Adds initial support for Sigma's windash modifier
Nothing first seen in this window. That doesn't mean chainsaw shipped nothing, only that we found no record of it.
How we count
Read from 1 of 13 release notes and docs updates we hold for chainsaw. "First seen" is the earliest note that names something; "last" is the latest. Our history may start partway through chainsaw's life, so an old integration can show a recent first-seen date.
Each change counts once: "added 40 checks" is one line, so the numbers measure how often coverage moves, not how big the catalogue is or how well it detects.
Releases
13 entries
No entries match these filters.
- October 20261
- May 20261
- December 20242
- August 20241
- July 20231
- April 20231
- February 20232
- October 20221
- September 20221
- February 20221
- January 20221
Project health
Issue, contributor and maintainer activity in WithSecureLabs/chainsaw, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 4 −6 vs prior 12 months
- Maintainers 2 +1 joined · −2 left, last 12 months
- Bus factor 1 committers behind half the commits
- Community-filed not measured of issues opened, last 12 months
- Median time to close not measured issues closed, last 12 months
- Open backlog not measured open issues today
- Issues opened / month not measured
- Open backlog not measured
- Contributors / month 1
- Commits / month 3
- Stars 3,662
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →