Lion Cipher Lab
Hunt Windows Event Logs with Chainsaw and Sigma
- SOC Analyst / Blue Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Sooner or later a defender is handed logs from a machine that might be compromised — a folder of .evtx (Windows Event Log) files pulled off a suspect host, often by a collection tool like KAPE. Opening them one at a time in Event Viewer and scrolling does not scale: a single host can hold hundreds of thousands of events across dozens of logs. Chainsaw, a fast Rust command-line tool from WithSecure Labs, is built for exactly this first-responder moment — it searches and hunts .evtx at speed and can apply the entire SigmaHQ rule set in one pass, turning a wall of raw events into a short table…
What you'll learn
- triaging Windows Event Log (.evtx) files with Chainsaw
- running Sigma rules at scale over acquired logs
- the --mapping requirement for Sigma hunts
- reading a detection table (timestamp, rule, level, event data)
- keyword and Event ID triage with chainsaw search
- treating a detection as a lead, not proof
Steps in this lab
- The vocabulary, up front (EVTX, hunt, triage, IOC)
- What Chainsaw is — and how it differs from a SIEM and from Hayabusa
- Get Chainsaw — download the release binary
- Get logs to hunt over — real attack samples
- Triage first — chainsaw search
- The main event — chainsaw hunt with Sigma (and the mapping trap)
- Make the output usable — output, format, and filtering
- When to reach for Chainsaw — and when NOT to
- A detection is a lead, not a verdict