Challenge

A Logs/ directory of Windows event logs (.evtx) and four questions about an intrusion — when Defender’s real-time protection was disabled, which finding had the most detections, and so on — each answered with a timestamp in YYYY-MM-DD_HH:MM:SS format. The answer-submission endpoint had broken rate limiting that you could sidestep just by opening a fresh connection.

Approach

.evtx is awkward to grep by hand, so the workflow was Chainsaw plus the Sigma ruleset. Clone both repos (Chainsaw ships the Sigma mappings; the Sigma repo provides the rules) and run a full hunt:

chainsaw hunt --mapping chainsaw/mappings/sigma-event-logs-all.yml \
  --rule chainsaw/rules --sigma sigma/ Logs/ --full

For targeted questions, search by Event ID directly:

# When was Real-Time Protection disabled? (Defender event 5001)
chainsaw search -t 'Event.System.EventID: =5001' Logs

That pinned the Defender real-time-protection-disabled event to 2024-04-17_14:27:08. The “most detections” finding landed a minute later at 2024-04-17_14:28:00, and the remaining questions came out of the PowerShell ScriptBlock logging (event ID 4104), which recorded the attacker’s scripts in full.

With the Chainsaw output in hand, the timeline answered every question.

Answers

  • Real-Time Protection disabled: 2024-04-17_14:27:08
  • Finding with the most detections: 2024-04-17_14:28:00