James D

v2 highlights💡 📖 Support for event logs in XML and JSON format 🎯 Increased sigma rule logic support. More detections! 📘 Chainsaw output displays important information more clearly 🔎 Better filtering/searching options 🦖 Updated Velociraptor Plugin bit.ly/3woOaFz

I'm excited to release a tool that I wrote at @countercept to help triage Windows event logs. Chainsaw is a RUST CLI tool to quickly search and hunt through event logs. It supports @sigma_hq detection rules to identify potential threats. More info here: github.com/countercept/chain…

Really excited to see this project being open-sourced, if you’re looking for a lightning fast way to tag documents with detection logic, check this out! If everything goes to plan, I’ll be releasing a tool in a couple of weeks that uses tau-engine to speed up threat hunting…

Haha, seems like a common theme: We saw an actor watch a YouTube video on how to use advanced ip scanner 🤦‍♂️ labs.f-secure.com/blog/prelu…

Just checked some code, you can also check for duration (time from 1st connection to most recent) and number of overall connections to help remove FPs. Using an ETW feed that gives you the source process means you can also filter out noisy processes which is nice:

@Andrew_knows @_mormaid

New favourite add on to my laptop

@adamjsho finally got his crest cert... #BSidesLDN2015