chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
파일 탐색기
최종 버전 다운로드 (.zip)- v1.yml
- v2.yml
- CODEOWNERS
- shimcache_patterns.txt
- chainsaw.png
- sigma-event-logs-all.yml
- sigma-event-logs-legacy.yml
- new_user_created.yml
- user_added_to_global_group.yml
- user_added_to_local_group.yml
- user_added_to_universal_group.yml
- f-secure.yml
- f-secure_legacy.yml
- kaspersky.yml
- mcafee.yml
- sophos.yml
- symantec.yml
- windows_defender.yml
- windows_security_essentials.yml
- eid_8002_applocker_lolbins_allowed_to_run.yml
- eid_8002_applocker_reconnaissance_allowed.yml
- eid_8002_lolbin_lateral_mouvement.yml
- eid_8002_privilege_escalation.yml
- eid_8004_applocker_exe-dll_blocked.yml
- eid_8007_applocker_msi-script_blocked.yml
- kerberoasting_administrator.yml
- weak_kerberos_ticket.yml
- T1562.001 - Sysmon Service set to Manual.yml
- T1562.001 - Sysmon Service was Disabled.yml
- T1070.009 - Scheduled Task was Deleted.yml
- batch_logon.yml
- interactive_logon.yml
- network_logon.yml
- rdp_logon.yml
- service_logon.yml
- T1021.004 - Lateral Movement via SSH.yml
- unlock_logon.yml
- security_audit_log_was_cleared.yml
- system_log_was_cleared.yml
- account_brute_force.yml
- eid_20220_20227_rasvpn_client_connection_error.yml
- eid_20221_to_20225_rasvpn_client_connection_establishment.yml
- eid_20226_rasvpn_client_connection_termination.yml
- eid_20250_20274_rasvpn_server_logon.yml
- eid_20253_20255_connection_error.yml
- eid_20271_rasvpn_server_authentication_error.yml
- eid_20272_20275_rasvpn_server_logoff.yml
- eid_1307_rdcb_successful_client_redirection.yml
- eid_800_rdcb_connection_request_received.yml
- eid_801_rdcb_connection_request_successfully_processed.yml
- eid_200_rdgw_rd_cap_requirements_met.yml
- eid_300_rdgw_rd_rap_requirements_met.yml
- eid_302_rdgw_user_connected_to_resource.yml
- eid_303_rdgw_user_disconnected_from_resource.yml
- eid_4624_rdwa_logon.yml
- eid_5_user_profile_service_registry_file_loaded.yml
- T1053.005 - Scheduled Task was Created.yml
- T1547.004 - Winlogon System Shell Changed.yml
- eid_400_powershell_engine_state_available.yml
- eid_403_powershell_engine_state_stopped.yml
- eid_4104_powershell_script_executed.yml
- eid_21_rdp_session_logon_succeeded.yml
- eid_22_file_explorer_shell_appeared_in_rdp_session.yml
- eid_23_rdp_session_logoff.yml
- eid_39_rdp_session_disconnected.yml
- event_id_1149.yaml
- event_id_24.yaml
- event_id_25.yaml
- event_id_4624_logontype_10.yaml
- credential_dumping_tools.yml
- csexec.yml
- krbrelayup.yml
- meterpreter_cobalt_strike_getsystem.yml
- powershell.yml
- processhacker.yml
- remote_access_tools.yml
- smbexec.yml
- suspicious_commands.yml
- suspicious_paths.yml
- sysinternals_psexec.yml
- tap0901.yml
- event_log.yml
- mssql_sus_behavior.yml
- remote_registry_usage.yml
- xp_cmdshell_enabled.yml
- action1_mft.yml
- adamntds_dit_mft.yml
- advanced_ip_scanner_mft.yml
- advanced_port_scanner_mft.yml
- angry_ip_scanner_mft.yml
- anydesk_mft.yml
- anyviewer_mft.yml
- ateraagent_mft.yml
- browserscan_mft.yml
- conhost_mft.yml
- filezilla_mft.yml
- kslkatz_mft.yml
- lazagne_mft.yml
- lsass_dmp_mft.yml
- megasync_mft.yml
- meshagent_mft.yml
- mimikatz_mft.yml
- netexec_mft.yml
- netscan_mft.yml
- nirsoft_mft.yml
- ntds_dit_mft.yml
- procdump_mft.yml
- processhacker_mft.yml
- psexec_mft.yml
- pstools_mft.yml
- rclone_mft.yml
- rubeus_mft.yml
- scvhost_mft.yml
- shadow_dumper_mft.yml
- splashtop_mft.yml
- sup_script_exec_intel_mft.yml
- sup_script_exec_perflogs_mft.yml
- sup_script_exec_program_files_root_mft.yml
- sup_script_exec_programdata_mft.yml
- sup_script_exec_public_mft.yml
- sup_script_exec_recyclebin_mft.yml
- sup_script_exec_recyclebin_nonstand_mft.yml
- sup_script_exec_root_mft.yml
- sup_script_exec_root_nonstand_fold_mft.yml
- sup_script_exec_root_temp_mft.yml
- sup_script_exec_rtlo_mft.yml
- sup_script_exec_user_desktop_mft.yml
- sup_script_exec_user_downloads_mft.yml
- sup_script_exec_user_mft.yml
- sup_script_exec_windows_root_mft.yml
- sup_script_exec_windows_temp_mft.yml
- svch0st_mft.yml
- svchost_mft.yml
- systeminformer_mft.yml
- tacticalrmm_mft.yml
- tokenduplicator_mft.yml
- winscp_mft.yml
- xenallpasswordpro_mft.yml
- evtx.rs
- gaps.rs
- mod.rs
- shimcache.rs
- srum.rs
- mod.rs
- tau.rs
- mod.rs
- srum.rs
- amcache.rs
- mod.rs
- shimcache.rs
- srum.rs
- evtx.rs
- json.rs
- mft.rs
- mod.rs
- xml.rs
- chainsaw.rs
- mod.rs
- sigma.rs
- cli.rs
- hunt.rs
- lib.rs
- main.rs
- search.rs
- value.rs
- write.rs
- sigma_collection.yml
- sigma_collection_output.yml
- sigma_simple.yml
- sigma_simple_output.yml
- clo_hunt_r_any_logon.txt
- clo_search_q_jsonl_simple_string.txt
- clo_search_q_simple_string.txt
- clo_search_qj_simple_string.txt
- rule-any-logon.yml
- security_sample.evtx
- analysis_srum_database_json.txt
- analysis_srum_database_table_details.txt
- SOFTWARE
- SRUDB.dat
- clo.rs
- common.rs
- convert.rs
- .gitignore
- .gitmodules
- Cargo.lock
- Cargo.toml
- flake.lock
- flake.nix
- LICENCE
- README.md
# 설치 가이드
1. 코드 내려받기
git clone https://github.com/WithSecureLabs/chainsaw
깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.
cd chainsaw
방금 내려받은 프로젝트 폴더 안으로 이동합니다.
2. Rust
보통 추천사전 준비물
- Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
- Rust (rustup) rustup으로 설치하면 cargo도 함께 설치됩니다.
cargo build --release
Rust 프로젝트를 컴파일합니다.
cargo run
빌드 후 바로 실행까지 진행합니다.
cargo build가 에러 없이 끝나면 성공입니다. target/ 폴더에 실행 파일이 생성됩니다.
// repository documentation
Was this content helpful?
(0 ratings)