Project Obsidian: Using Chainsaw for Rapid Windows Event Log Triage
Project Obsidian demonstrates using Chainsaw and Sigma rules to rapidly parse gigabytes of Windows event logs and identify malicious artifacts.
Summary
Danny Henderson (Bane) demonstrates high-speed digital forensics and incident response (DFIR) triage in "Using Chainsaw to Identify Malicious Activity," part of the Blue Team Village Project Obsidian workshop series.
[03:08] Henderson introduces "Chainsaw," an open-source, high-performance forensic tool written in Rust designed to rapidly search, parse, and extract intelligence from Windows Event Logs (.evtx). He explains how Chainsaw addresses the performance bottlenecks of native Event Viewer and slower PowerShell scripts when analyzing gigabytes of event logs across dozens of compromised endpoints.
[07:43] The workshop walks through practical command syntax and flag configurations, demonstrating how to execute generic string searches, extract targeted event IDs (such as logon failures, service creation, and process execution), and map activity chronologically. Henderson showcases Chainsaw's integration with Sigma detection rules [12:36], demonstrating how the tool automatically detects adversary behaviors [16:44]—including credential dumping, suspicious scheduled task generation, and lateral movement via PsExec—generating structured output that dramatically accelerates incident triage.
(AI summary — Gemini Flash)
Related talks
CODE BLUE·29 min
Analysts investigate attack surfaces and defenses concerning [CB22]Hayabusa - Threat Hunting and Fast Forensics in Windows environments for free!.
Blue Team Village·17 min
Saurabh Chaudhary
Saurabh Chaudhary demonstrates crafting high-performance, modular YARA rules to detect complex malware variants and streamline threat hunting.
Blue Team Village·46 min
Project Obsidian
Project Obsidian explains forensic preparation and tooling organization to accelerate digital forensics and incident triage workflows.