Hello and welcome to the Wednesday, September 21st, 2020 edition of the Sansonet Storm Center's

Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

One of the questions I'm getting a lot when talking about incident response in forensics is where

to start if you are confronted

with an incident, and of course doing so relatively quickly. Sometimes it's pretty straightforward.

You have a specific system and a specific piece of malware to deal with. Ransomware is always

pretty straightforward, of course, to pin down because you usually have this warning screen telling you what it's all about.

But it can be difficult to analyze all the different logs

that you may have access to.

And again, speed off matters.

So Rustaday wrote about a nice tool to assist with this task. Chainsaw. Chainsaw is a simple command line tool

that can read logs and extract relevant logs. That's really the key here. You always have a ton of

logs, but it's hard to find a couple lines that really matter. Chainsaw uses a common Sigma rule format, so you'll likely find some nice rule sets ready to use in addition to its own build-in rules. To demonstrate the capabilities of chainsaw, Russ first used data from an older incident he worked on, and it did a great job identifying some of the

relevant pieces of software involved in the incident. In addition, Russ then used data from

APT simulator, a tool that simulates activity that's sort of consistent with what's commonly known

as APT attacks.

This time, Russ used chainsaws built-in rules as well as some Sigma rules.

And again, chainsaw's own rules found that an administrator account was added.

That's, of course, always nice to know.

And Sigma rules then identified password dumping activity and... administrator account was added. That's of course always nice to know.

And Sigma Rules then identified password dumping activity and other relevant artifacts.

More about this in Russ's diary post. So in short, a very useful tool to at least get a decent first cut of what is odd and interesting,

...