Suivre
A standalone SIGMA-based detection tool for EVTX.
Zircolite is a standalone tool written in Python 3 allowing to use SIGMA rules on Microsoft Windows EVTX logs. Code is light (less than 500 lines) and simple. For now, evtx_dump is 64 bits only so if you use zircolite.py with evtx files as input you can only execute it on a 64 bits OS.
