Open IppSec opened 3 weeks ago
I think there's two parts to this ask:
1.) Extend chainsaw to be able to dump out MFT Resident Files
This should be easy enough, the underlying library supports this we just need to wire it in.
2.) Support String Search / Yara Search on the Resident Files
This might be a little more tricky.
I'll have a look at solving part 1 first, then we can see how much of a lift it will be to add in string/yara search for the streams.
It would be nice to be able to extract/hunt on MFT Resident Files. I don't believe this would be a big lift as it looks like mft_dump does support it which I think uses the same library Chainsaw uses to dump the MFT.
Example of usefulness:
I'd expect to replace my "grep" with a yara or something.
Hopefully this feature doesn't exist already, I did look through options and search the code for "resident" and didn't come up with anything.