Transcription
Good morning, good evening, and good afternoon to those at Defcon. I am Danny Henderson. I go by Bandito or Bandit Zero. I am part of a forensics team, and we're going to learn how to use Chainsaw to identify malicious activity.
Now, what is Chainsaw, you ask? Well, we're gonna go over that. This is going to be a quick. The slides are going to be quick because we're going to get right into the action. But to give an overview of Chainsaw, it is an incident response tool that can that you can use to quickly gather the data from the Windows event logs. It is a command-line tool that uses a Sigma rule detection logic. You can either search by keyword, regex, or just specific IDs, or you can hunt using its built-in tools or Sigma rules. The useful thing about it is that you can export the data to text files or CSVs to put in a spreadsheet so you want to carve more information out. So let's get right into it.
Sigma rule. Now, this is a generic signature for SIMs that is, like I said, targeted Windows events. So it is to event logs as Yara is to malware. And we have an example here from Integer, in fact, of how you would generally set up a Sigma rule. Now, without further ado, let's let it rip.
So the first thing we want to do is go just pull up Chainsaw itself. You get the nice view of the console with the use with the instructions of how to use it. So let's take a look at the help. Same thing, version, which is already on the screen, but oh, thanks. Yeah, there we go. So that's it. We want to go to various each part. So let's go. We're gonna go for two things. There's two things that we're going to use throughout the event. So let me clear this log right quick. There's two aspects that we're gonna go for. Search is gonna be our first one. Search and Hunt are the ones that we use the most.
Now, searching, as I mentioned in the first slide, in one slides that you can search through the event IDs or keywords or even use regex. The Hunt is where you're going to be doing it's a little more automated. So let's go through the search first. So you want to look into the search help. So we're doing this case, uh, step by step. Now, the flags here, you can put the search for case insensitive. Now, this is only usable for string search because I've attempted this with the regex, and that's not going to work. Now, we can use the flags for either the events, regex, and strings, and we may want to make an output of it. So let's begin on that. So we, uh, so this for the obsidian event, we have kill chain one and three. We're gonna start with kill chain three for the search aspects. So we got two holes that was part of the compromise. So we're gonna use that for the example of how regex can help you identify what's going on. So what we're going to do here, we're going to use the event ID 4104, which is associated with the PowerShell.
So let's scroll up for just a bit. Let's scroll up as much as we can because things happen very fast, and it may actually be better if we just did a more. Let's let it go slowly. Now, note it searched through 311 logs, and this is part of the output that it found. You have many attributes such as the event data, the paths, what that text is, and for this is a big chunk.
Now, next, we're going to do the strings next. So there's two things that we could do with for the strings. We're going to go with the we're going to remove the insensitive one. We're not going to use that one. We will instead just use as is. You will find in this example, this actually did work. So in this case, you see signs of Kerberoasting. So only one event was found, which is part of the Windows event logs, and this is pulled from the PowerShell operational log. It's one, two, three. So we found that aspect.
Now, we're going to do something different. We're going to do a regex. Now, this, as I mentioned before, it's also able to do regex. This time we're going to do another, uh, device, which was the domain controller. Oh, what was that? Now, the reason why, um, let's get one moment. Oops. That's why. Now, here we do have this gone fast. So first, we're going to do two things. We're going to do more just to go through it slowly. So here we can see PsExec service or PsExec service. The create keys system on. We have the service here from the Sysmon. Now, let's do this just to show you another way of seeing how how much did we grab. So most of this has been part of the service. Next up.
Now we want to do. Oh, and here we actually have PsExec with one of the keys. So that's another example of what we have of a different one. So the regex was used to find the service as well as the PsExec, which we found with the RDP key associated. And now we want to save it to an output. So there we go. On one hand, we do have it as an output on here. On the other hand, it doesn't look the greatest, but hey, you do have a way of putting it on here. And even more, let's take a look at the downloads.
Okay, now back to the next part. So we're going to move on to the other capability of Chainsaw. Now, this is the other aspect called The Hunt. This we can use the built-in tools of Hunt. So we're gonna go with actually do some cleanup here. Okay, cleanup done. First, we're going to take a look at the help. Now, there's very, there are various flags. We can, it, we can save it as a C as the individual CSV files. We can ask it to not use the built-in tools. Go full, which this can be useful for the PowerShell because some of it's going to truncate. We can also leverage the lateral all. So let's do this one first. Run check on one of the workstations. This one's going to be with the built-in tools.
So we're going to do a hunt. We didn't add anything new to it, but we do have a nice output out of this. Now, we also see that it takes everything out. So here we at least have some activity from the built-in logic, such as the security audit being cleared at 0.35. We also have users added to the local group four. We have indications of brute forcing.
Now, we're going to, let's actually go to workstation two. Then we're going to add lateral all to if there's indications of lateral movement. Now, here you have potential activity related with lateral movement, such as the user added into the local group as well, the system logs being cleared, and the 4624 successful connections where you see a lot of connections on to workstation two, whereas others you see a system associated with it.
Now, what we want to do next is use the Sigma rules. So this one's handled differently. You have to, in order to use the Sigma rule, you have to add a certain, you have to add multiple flags to it. So we're going to put rules. So we've added the Sigma rules and then mapping. Uh, let's do more just to not have it take everything at once. So no, no, one screens are scrolled on here. Now, this one is going through 835 detection rules out of the 311 event logs. Of those detection rules, we see 90 of them were not loaded. So here we see activity that was not associated with the built-in logic. Powershell indications.
When I mentioned about the full, this part here is where it talks about the use the full flag to show all content. So we're probably going to do that on the next go.
And this time, we're going to build this fully. Also, we can scroll up and see the other events that happens at once. It'd be easier that way. So we're letting it, letting the Chainsaw rip through once more. The nice thing about this is that it can go through the logs very quickly. Now we see indications of the user being added, security audit, and as I mentioned before, more suspicious activity. Sometimes these may be noise itself. The suspicious file creation, these may be more noise, but what this allows you to do is it gives you an opportunity to analyze it. So despite the automation behind it, you still have to be part of, you still have to have the analyst behind it to decipher what's going on.
And mentioned earlier, we're going to add the CSV flag. Now you see that it, for here, it created multiple files on CSV files. One is based off of the external rules and then also the built-in logic. So it separates them. So let's open this back up and take a look at the CSV itself. Yep, this folder, and we're going to open up the external rule here. Yep. So it'll use the system time of the activity, as well as the ID, the event ID, associated detection rules, and the data. And let's take a look at the file suspicious file loading. So you see indications of suspicious modules that's worth investigating to rule out if this was malicious or not. But the thing about the tool is that it gives you a faster way to analyze the data to create it as a collector, a triage collector. That's important thing about this. And we're just going to open it with Pluma just to see the at your CSV itself. And that is actually the way of Chainsaw.
Now, if you want to use Chainsaw for your own investigations, you can grab it and get the GitHub. Just remember the installation side. Remember to tag the submodules to recurse because if you don't, you will not have access to the attack samples or Sigma rules to work with. I'll leave you all with one final note. Chainsaw has been a great tool to which has helped us with the investigation for the Obsidian project. We recommend everyone, and I personally recommend everyone having this in their library when they're doing their own, even their own incident investigation. So, penny for the questions. I will see you all later.