Tool
Chainsaw
- First Reported
- Jul 26, 2022
- Latest Reported
- Jun 15, 2026
Reported Context (4)
- However, the Terminal Services operational logs did, so we parsed them with Chainsaw. Attackers Used a Compromised Terminal Server to Stage a Boots Phishing Campaign
- Figure 2: Screenshot of Chainsaw output showing account brute forcingIn other cases, we don’t observe any brute force activity but simply a login from an account stemming from a suspicious IP address. In these cases, we Huntress Shares Initial-Access Findings and Hardening Advice for RDP, SMB, and VPNs
- We can use Chainsaw, which essentially allows us to quickly ‘grep’ through the WEVTXs. Chainsaw does have a summary ‘hunt’ mode, but don’t rely on just this feature alone. Instead, Chainsaw’s search mode is an advanced Huntress Explains How Analysts Investigated an Ambiguous Defender Alert
- have compromised and controlled and initial access or persistence activities. You can use tools like Chainsaw to help you parse through logs. Practical Tips for Investigating Intrusions with Digital Forensics
People (7)
MITRE ATT&CK (9)
Vendors (2)
Products (6)
Tools (8)
Industries (2)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.