Alternatives to Chainsaw
Search Windows forensic records for suspicious activity. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Chainsaw
Search Windows forensic records for suspicious activity.
Replacements
Listings that take over the same core job as Chainsaw.
Hayabusa
Build investigation timelines from Windows event logs.
Hayabusa also hunts through Windows event logs with detection rules, but focuses on building investigation timelines and is licensed AGPL-3.0 instead of GPL-3.0.
Velociraptor
Endpoint monitoring and digital forensics platform driven by a query language.
Velociraptor is a full endpoint monitoring and forensics platform with its own query language, so it collects across a fleet but needs more planning than a single command-line tool.
Similar software
Related functionality, not a direct replacement.
Autopsy
Digital forensics platform for disk, file and timeline analysis.
Volatility 3
Memory forensics framework for extracting artefacts from RAM images.
YARA
Pattern-matching engine for identifying and classifying malware samples.
Wazuh Agent
Endpoint agent that feeds a Wazuh server with security and compliance data.
SharpHound
A C# collector that gathers Active Directory data for attack path analysis in BloodHound.
Falco
Detect unusual runtime behavior on Linux systems.
