W3CSaw

Chainsaw-style DFIR hunting for IIS W3C logs. Parses IIS access logs, normalizes them, and applies Sigma-inspired YAML rules to surface web shells, exploitation, scanning, and brute force.