Chainsaw

chainsaw hunt <evtx> -s sigma-rules/

Search for Sigma detections on EVTX files (copies of Windows logs) with Chainsaw, in seconds and without setting up a SIEM.

Run it when you have copies of Windows logs (EVTX extracted with KAPE, or directly from C:\Windows\System32\winevt\Logs) and you want to run SigmaHQ rules against them without spinning up infrastructure: chainsaw hunt applies the rule set to the EVTX files and reports matches with event details. It's the IR tool that answers 'do these logs contain malicious activity?' in seconds, on the analyst's laptop, without sending anything anywhere. When triaging dozens of hosts, the chainsaw hunt loop over each EVTX set is the filter that decides which hosts get deep-dived.

Don't use it on live EVTX files from the system (files in use get read partially or fail): copy first (KAPE, or manual copy with the service stopped). The quality of the result depends on the rules: with the default SigmaHQ rules, false positives are possible — generic rules match legitimate activity; review each hit before declaring. And watch performance: an EVTX from weeks can be hundreds of MB and parsing with thousands of rules takes time; narrow down with --from, --to, and the EventIDs of interest. Chainsaw detects in logs, not on the host: malware only in memory leaves no trace here.