WithSecureLabs / chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

--json output not properly formatted?

high101bro opened this issue · comments

I saved the results as a json file. I believe there's a format error somewhere. When I paste the contents into a json syntax verifier it fails, and when I import it into PowerShell and convert it, it also fails.

.\chainsaw.exe hunt .\evtx_attack_samples\Execution\exec_persist_rundll32_mshta_scheduledtask_sysmon_1_3_11.evtx --rules .\sigma_rules\ --mapping .\mapping_files\sigma-mapping.yml --lateral-all --json .\results.json

Get-Content -raw .\results.json | ConvertFrom-Json
// Fails

This is already fixed in master and will be out in the next release.

V1.0.1 has been released.

Running with the same commands as above now results in the expected output:

image