Can this be run across network?

WithSecureLabs / chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

GNU General Public License v3.0

2.85k stars 259 forks source link

Closed PowerPress closed 3 days ago

PowerPress commented 3 days ago

Can this be run across network without?

If not what is the typical workflow?

For each machine export all the event logs and in a seperate directory and run chainsaw against each?

FranticTyping commented 3 days ago

Hey @PowerPress

There's no built-in way to run Chainsaw across the network. There are a couple of options you could explore though:

1.) Set up WEF forwarding to centralise event logs to a single machine 2.) Setup Velociraptor and use the Chainsaw module to run it remotely: https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.chainsaw/

Thanks!