Basic Hunt

chainsaw hunt --directory ./evtx --rules ./sigma

Search by Event ID

# v2
chainsaw search log.evtx -t "Event.System.EventID: =4104"

Search by String

# v2
chainsaw search log.evtx -e "IEX"

Timestamp Filtering

chainsaw search ./ \
  --timestamp Event.System.TimeCreated_attributes.SystemTime \
  --from 2022-06-21T00:00:00 \
  --to 2025-06-29T00:00:00

4624 — Logons

# Count IPs for a user
chainsaw search log.evtx -e 4624 -i -s "JoeBloggs" \
  | grep -i "ipaddress" | sort | uniq -c | sort -nr

# Show logon time and type
chainsaw search log.evtx -e 4624 -i -s "username_or_ip" \
  | grep -iE "ipaddress|targetusername|logontype|systemtime"

4625 — Failed Logons

# Count per user (brute force)
chainsaw search log.evtx -e 4625 \
  | grep -i targetusername | sort | uniq -c | sort -nr

4104 — Script Blocks

# Show all script blocks
chainsaw search log.evtx -e 4104 | grep -i "scriptblocktext"

# Filter for IEX
chainsaw search log.evtx -e 4104 \
  | grep -i "IEX" | sort | uniq -c

• sqlservr.exe — Main SQL Server engine
• sqlagent.exe — SQL Agent (job execution)
• sqlbrowser.exe — Instance enumeration
• launchpad.exe — R/Python script execution

• HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL
• HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL{XX}.{INSTANCE}\MSSQLServer\

• ...\MSSQL\Log\ERRORLOG
• ...\MSSQL\Data\
• ...\MSSQL\Backup\

# WHOIS lookup
whois example.com

# DNS records
dig example.com ANY +short
dig +trace example.com

# Alternative resolver
nslookup example.com 8.8.8.8

# IP geolocation / ASN
curl ipinfo.io/8.8.8.8
curl https://ipapi.co/8.8.8.8/json/

# Certificate history
curl "https://crt.sh/?q=%.example.com&output=json"

curl -I https://example.com          # View headers
curl -v -L https://short.url         # Follow redirects
curl -s https://example.com | html2text

# Custom headers (some C2s "authenticate" via headers)
curl https://example.com -A "CustomAgent"
curl https://example.com -H "Header: value"
curl https://example.com -b "cookie=value"
curl https://example.com --referer "https://source.com"

1. Use automated sandbox tools for initial assessment
2. Set up a controlled, isolated laboratory
3. Examine static properties and metadata for triage
4. Emulate code execution to identify capabilities
5. Perform behavioural analysis — interactions with environment
6. Statically analyze code with disassembler / decompiler
7. Dynamic code analysis for difficult aspects
8. Unpack the specimen if needed
9. Repeat steps 4–8 until objectives are met
10. Augment with memory forensics and threat intel
11. Document findings, save artifacts, clean up lab

• Extract strings: strings, FLOSS, pestr
• Analyze PE headers: pefile, pestudio, CFF Explorer
• Check imports/exports: dumpbin /imports, objdump -x
• Calculate hashes: md5sum, sha256sum, ssdeep (fuzzy)
• Examine resources: Resource Hacker, 7-zip
• Check digital signatures: sigcheck, osslsigncode
• Disassemble: IDA Pro · Ghidra · Binary Ninja · Radare2
• Decompile: Ghidra · IDA Hex-Rays · RetDec
• Identify capabilities: capa (MITRE ATT&CK mapping)
• Detect packer/compiler: Detect-It-Easy · PEiD · Exeinfo PE

• Detect packing: Detect-It-Easy · Exeinfo PE · Bytehist · peframe
• Quick unpack: infect VM and dump memory with Scylla
• Find OEP (Original Entry Point) via debugger, use OllyDumpEx
• Set breakpoints on: LoadLibrary, VirtualAlloc, etc.
• Use memory breakpoints at stack entry
• Rebuild dumped file with Scylla, pe_unmapper
• If dumping fails, use dynamic analysis live

• Decode obfuscated strings — static: FLOSS · xorsearch · Balbuzard
• Decode at runtime: set breakpoints and inspect memory
• Hide analysis tools: ScyllaHide plugin for x64dbg
• Patch out anti-analysis code manually
• Watch for tricky control flows: TLS · SEH · RET · CALL
• Use scdbg and runsc for shellcode
• Disable ASLR: setdllcharacteristics · CFF Explorer

• pe manalyze · peframe · pefile · exiftool · clamscan · portex · bearcommander
• strings pestr · bbcrack · base64dump · xorsearch · floss · cyberchef
• emulation binee · capa · vivbin
• disasm ghidra · cutter · objdump · r2
• unpack bytehist · de4dot · upx

• linux static trid · exiftool · pyew · readelf.py
• linux runtime edb · gdb · strace · ltrace · frida · sysdig · unhide
• network mon burpsuite · networkminer · polarproxy · mitmproxy · wireshark · tshark
• network svc inetsim · fakenet · fakedns · fakemail · accept-all-ips
• intel/hashes malwoverview · nsrllookup · vt · shodan
• memory vol3 · aeskeyfind · rsakeyfind · bulk_extractor

docker images                          # List images
docker pull <image>                    # Update image
docker rmi <image_id>                  # Remove image
docker system prune                    # Clean up
docker run --rm -it image bash         # Run container shell
docker run -p 80:80 image bash         # Map port
docker run -v .:/data image bash       # Mount directory

1. Examine document for anomalies — risky tags, scripts, embedded artifacts
2. Locate embedded code — shellcode, macros, JavaScript, suspicious objects
3. Extract suspicious code or objects from the file
4. If relevant, deobfuscate and examine macros, JavaScript, or other embedded code
5. If relevant, emulate, disassemble and/or debug extracted shellcode
6. Understand the next steps in the infection chain

zipdump.py file.pptx                  # Examine OOXML contents
zipdump.py file.pptx -s 3 -d          # Extract file index 3
olevba file.xlsm                      # Extract macros
oledump.py file.xls -i                # List OLE2 streams
oledump.py file.xls -s 3 -v           # Extract VBA code
xmldump.py pretty                     # Format XML for analysis
oledump.py file.xls -p plugin_http_heuristics   # Find obfuscated URLs
vmonkey file.doc                      # Emulate macro execution
evilclippy -uu file.ppt               # Remove macro password
msoffcrypto-tool infile.docm outfile.docm -p    # Decrypt file
pcodedmp file.doc                     # Disassemble stomped VBA
pcode2code file.doc                   # Decompile stomped VBA

pdfid.py file.pdf -n                  # Show risky keywords
pdf-parser.py file.pdf -a             # Show stats
pdf-parser.py file.pdf -o ID          # Display object ID
pdf-parser.py file.pdf -r ID          # Objects referencing ID
qpdf --password=pass --decrypt infile.pdf outfile.pdf

• olevba — Extract and analyse VBA macros
• oledump.py — Inspect OLE2 streams
• vmonkey — Emulate VBA macro execution
• pcodedmp — Disassemble stomped VBA p-code
• xlmdeobfuscator — XLM macro deobfuscation
• msoffice-crypt — Decrypt encrypted Office files
• ssview — Structured storage viewer

• rtfobj — Extract objects from RTF files
• rtfdump — Dump and analyse RTF structure
• emldump — Analyse .eml email files
• msgconvert — Convert .msg to .eml
• pdfid / pdf-parser / pdfdecrypt — Didier Stevens PDF toolkit
• peepdf — Interactive PDF analyser
• qpdf — Decrypt / transform PDFs
• pdftk · pdfresurrect · pdfobjflow

• JS deobfuscation SpiderMonkey · cscript · box-js
• macro debugging Built-in Office debugger in isolation
• macro monitoring AMSIScriptContentRetrieval.ps1
• general base64dump · tesseract · exiftool
• distributions REMnux includes many free tools

1. Examine static properties of the executable
2. Identify strings and API calls for suspicious indicators
3. Use behavioural analysis — manual and automated
4. Emulate to find characteristics
5. Static disassembly and decompilation
6. Dynamic debugging of API usage
7. Unpack code if needed
8. Annotate functions, rename variables
9. Expand analysis based on known code
10. Repeat steps 5–9 until objectives are met

• Use dynamic analysis when static stalls
• Map control flow via jumps and calls first
• Work from known to unknown — prefer simplicity
• Research native API names: Nt*, Zw*, Rtl*
• Look for anti-debugging checks early in execution
• Identify crypto constants (MD5, SHA, AES key schedules)
• Track cross-references (xrefs) to understand function usage
• Rename functions and variables as you understand them
• Use scripting (IDAPython, r2pipe) for repetitive tasks

• 32-bit → 64-bit: EAX → RAX, ECX → RCX, etc. · Registers R8–R15 added
• 64-bit args RCX, RDX, R8, R9
• 32-bit args [EBP+8], [EBP+0xC]...
• stdcall Args right-to-left · callee cleans stack
• cdecl Args right-to-left · caller cleans stack
• fastcall First 2 args in ECX/EDX · rest on stack
• Stack layout: ESP → top · EBP → base · locals at [EBP-X] · args at [EBP+X]

mov EAX, 0xB8       ; Load value into register
push EAX            ; Push onto stack
pop EAX             ; Pop from stack
lea EAX, [EBP-4]    ; Load effective address
call EAX            ; Call function by address
ret                 ; Return from function
add ESP, 8          ; Adjust stack (cleanup)
sub ESP, 0x20       ; Allocate stack space
xor EAX, EAX        ; Zero a register
test EAX, EAX       ; Check if zero
cmp EAX, 0xB8       ; Compare values
jmp 0x401000        ; Unconditional jump
nop                 ; No operation (0x90)
int 3               ; Breakpoint (0xCC)

• prologue push ebp; mov ebp, esp; sub esp, X
• epilogue mov esp, ebp; pop ebp; ret
• string refs push offset aStr; call printf — look for offsets to data section
• API call call dword ptr [iat_entry] — indirect via IAT
• obfuscated call push eax; ret — return-based obfuscation
• XOR decode xor byte ptr [esi], 0x42; inc esi; loop
• stack strings Built on stack to avoid static detection
• API hashing call hash_fn; cmp eax, 0xDEADBEEF

• DOS header → NT headers → section headers
• IAT (Import Address Table) — populated at runtime with function addresses
• EAT (Export Address Table) — exported function names and addresses
• Resources section — icons, strings, embedded payloads
• TLS callbacks — execute before main(), used for anti-debug

• CreateRemoteThread
• NtCreateThreadEx
• WriteProcessMemory
• ReadProcessMemory
• VirtualAlloc / VirtualProtect
• NtAllocateVirtualMemory

• LoadLibrary / LdrLoadDll
• GetProcAddress
• CreateProcess / WinExec
• ShellExecute / system
• InternetOpen / WinHttpOpen
• URLDownloadToFile
• HttpSendRequest

• GetClipboardData / GetWindowText
• GetAsyncKeyState / GetForegroundWindow
• SetWindowsHookEx
• RegSetValue / CreateService
• CreateFile / WriteFile / DeleteFile / MoveFile
• IsDebuggerPresent
• CheckRemoteDebuggerPresent
• OutputDebugString

• Ghidra — Free NSA tool, powerful decompiler, multi-arch
• IDA Pro — Industry standard, Hex-Rays decompiler (commercial)
• Binary Ninja — Modern disassembler with BNIL and scripting
• Radare2 — Open-source RE framework with r2pipe scripting
• x64dbg — Modern open-source Windows debugger (32/64-bit)
• WinDbg — Microsoft's powerful Windows debugger
• OllyDbg — Classic 32-bit Windows debugger

• Malcat — Hex editor + malware analysis platform
• PEStudio — Malware initial assessment for PE files
• CFF Explorer — PE editor with many features
• PE-bear — Portable executable viewer and analyser
• Detect-It-Easy — Packer / compiler / obfuscator detector
• CAPA — Identify capabilities (MITRE ATT&CK mapping)
• Dependencies — Modern Dependency Walker replacement
• API Monitor — Monitor and control API calls
• FLOSS — Obfuscated string solver
• binwalk — Firmware analysis and extraction
• Scylla — Import reconstruction and dump fixing
• OllyDumpEx — Process dumping plugin for OllyDbg
• de4dot — .NET deobfuscator and unpacker
• dnSpy — .NET debugger and assembly editor

• Malware Unicorn RE101/RE102 — Excellent RE workshops
• Practical Malware Analysis — Classic malware analysis textbook
• OpenSecurityTraining2 — Free security training including RE courses
• Reverse Engineering for Beginners — Free book by Dennis Yurichev
• FLARE-On Challenge — Annual RE CTF by Mandiant
• Malware Analysis Bootcamp — Comprehensive video course
• OALabs YouTube — Malware analysis tutorials and research
• Exploit-DB — Exploit database and vulnerable software repo