https://cybertoolchain.io/tools/chainsaw New releases and features in chainsaw, tracked by The Cyber Toolchain. en Wed, 14 Oct 2026 17:48:47 GMT https://github.com/WithSecureOpenSource/chainsaw/releases/tag/v2.17.1 https://github.com/WithSecureOpenSource/chainsaw/releases/tag/v2.17.1 Wed, 14 Oct 2026 17:48:47 GMT Chainsaw v2.17.1 adds initial support for Sigma's windash modifier and fixes lint exit codes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds initial support for Sigma's `windash` modifier, enabling detection rules that use windash-based pattern matching to be correctly processed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainsaw https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.16.0 https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.16.0 Sat, 09 May 2026 10:08:37 GMT Chainsaw v2.16.0 adds an EVTX summary command for quick log overviews. • New `summary` command provides an at-a-glance summary of EVTX event log files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainsaw https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.11.0 https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.11.0 Sat, 28 Dec 2024 18:22:23 GMT Chainsaw v2.11.0 adds MFT data stream extraction and querying via Search and Hunt commands. • Extracts, decodes, and writes MFT data streams to disk via the improved MFT parser. • Enables querying of decoded MFT data streams through the Search command. • Enables querying of decoded MFT data streams through the Hunt command. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainsaw https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.10.4 https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.10.4 Tue, 24 Dec 2024 14:24:41 GMT Chainsaw v2.10.4 adds a --skip-errors hint and richer hunt progress logging with elapsed time and current file. • Adds a `--skip-errors` helper message when a hunt exits early, guiding users to resume past problematic artefacts. • Improves `hunt` progress logging to display elapsed time and the current artefact file being processed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainsaw https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.10.0 https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.10.0 Sat, 24 Aug 2024 15:29:30 GMT Chainsaw v2.10.0 adds a Key/Value (kv) container for extracting key-value pairs from strings in detection rules. • Adds the `kv` (Key/Value) container type for extracting key-value pairs from strings within detection rules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainsaw https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.7.0 https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.7.0 Mon, 03 Jul 2023 10:35:57 GMT v2.7.0 adds disk-backed caching for JSONL output, file path field in CSV outputs, and warning highlighting for rule loading issues. • Adds `--cache-to-disk` flag to enable persistent cache storage for JSONL output streams • Adds `file_path` column to CSV output format • Adds warning-level log output when rule loading warnings occur Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainsaw https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.6.0 https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.6.0 Mon, 03 Apr 2023 13:10:43 GMT Chainsaw v2.6.0 adds execution timeline creation from shimcache/amcache and Windows registry hive parsing • Adds execution timeline generation using shimcache artifacts with optional amcache enrichment. • Adds `parse` functionality for Windows registry hive files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainsaw https://github.com/WithSecureOpenSource/chainsaw/releases/tag/v2.4.0 https://github.com/WithSecureOpenSource/chainsaw/releases/tag/v2.4.0 Fri, 17 Feb 2023 09:43:52 GMT Chainsaw v2.4.0 adds --jsonl streaming, configurable thread count, and preprocessing to the hunt command for large-scale file processing. • Adds `--jsonl` output mode to the `hunt` command to stream results and reduce RAM usage on large file sets • Allows configuring the number of threads via `--threads` flag in the `hunt` command Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainsaw https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.2.0 https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.2.0 Thu, 20 Oct 2022 15:01:22 GMT chainsaw v2.2.0 adds newline-delimited JSON output support • Support for outputting in newline delimited JSON • Allows for preconditions to be applied in mapping files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainsaw https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.1.0 https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.1.0 Fri, 16 Sep 2022 15:21:52 GMT Chainsaw v2.1.0 adds NDJSON support, MFT parsing, and re-adds evt file support • Adds support for new line delimited JSON (NDJSON) input/output • Adds support for Master File Table (MFT) analysis • Re-adds support for `evt` log files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainsaw https://github.com/WithSecureOpenSource/chainsaw/releases/tag/v1.1.6 https://github.com/WithSecureOpenSource/chainsaw/releases/tag/v1.1.6 Sun, 20 Feb 2022 17:41:58 GMT Chainsaw v1.1.6 adds the `output` subcommand to dump test results in structured formats. • Adds the `chainsaw output` command to export test suite results. • Updates README documentation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/chainsaw