Linux evtx чем открыть

Saved searches

Use saved searches to filter your results more quickly

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

wagga40/Zircolite

This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Sign In Required

Please sign in to use Codespaces.

Launching GitHub Desktop

If nothing happens, download GitHub Desktop and try again.

Launching GitHub Desktop

If nothing happens, download GitHub Desktop and try again.

Launching Xcode

If nothing happens, download Xcode and try again.

Launching Visual Studio Code

Your codespace will open once ready.

There was a problem preparing your codespace, please try again.

Latest commit

Update Mitre Att&ck (c) reference table

Git stats

Files

Failed to load latest commit information.

Readme.md

Standalone SIGMA-based detection tool for EVTX, Auditd, Sysmon for linux, XML or JSONL/NDJSON Logs

Zircolite is a standalone tool written in Python 3. It allows to use SIGMA rules on : MS Windows EVTX (EVTX, XML and JSONL format), Auditd logs, Sysmon for Linux and EVTXtract logs

• Zircolite can be used directly on the investigated endpoint or in your forensic/detection lab
• Zircolite is relatively fast and can parse large datasets in just seconds (check benchmarks)
• Zircolite is based on a Sigma backend (SQLite) and do not use internal sigma to «something» conversion
• Zircolite can export results to multiple format with using Jinja templates : JSON, CSV, JSONL, Splunk, Elastic, Zinc, Timesketch.

Zircolite can be used directly in Python or you can use the binaries provided in releases. Documentation is here.

Python 3.8 minimum is required. You can install dependencies with : pip3 install -r requirements.txt

The use of evtx_dump is optional but required by default (because it is -for now- much faster), If you do not want to use it you have to use the —noexternal option. The tool is provided if you clone the Zircolite repository (the official repository is here).

⚠️ the evtx library may need Rust and Cargo to be installed.

Help is available with zircolite.py -h . If your EVTX files have the extension «.evtx» :

# python3 zircolite.py --evtx --ruleset [--ruleset ] python3 zircolite.py --evtx sysmon.evtx --ruleset rules/rules_windows_sysmon.json

The SYSMON ruleset used here is a default one and is for logs coming from endpoints where SYSMON is installed.

Rules can be updated using the -U or —update-rules options.

Auditd / Sysmon for Linux / JSONL or NDJSON logs :

python3 zircolite.py --events auditd.log --ruleset rules/rules_linux.json --auditd python3 zircolite.py --events sysmon.log --ruleset rules/rules_linux.json --sysmon4linux python3 zircolite.py --events JSON_FOLDER or JSON_FILE> --ruleset rules/rules_windows_sysmon.json --jsononly

ℹ️ If you want to try the tool you can test with EVTX-ATTACK-SAMPLES (EVTX Files).

The Mini-GUI can be used totally offline, it allows the user to display and search results. You can automatically generate a Mini-Gui «package» with the —package option. To know how to use the Mini-GUI, check docs here.

Detected events by Mitre Att&ck (c) techniques and criticity levels

Detected events by Mitre Att&ck (c) techniques displayed on the Matrix

Tutorials, references and related projects

• Russ McRee has published a pretty good tutorial on SIGMA and Zircolite in his blog
• César Marín has published a tutorial in spanishhere

• Florian Roth cited Zircolite in his SIGMA Hall of fame in its talk dugin the October 2021 EU ATT&CK Workshop in October 2021
• Zircolite has been cited and used in the research work of the CIDRE team : PWNJUSTSU — Website and PWNJUSTSU — Academic paper
• Zircolite has been cited and presented during JSAC 2023

Zircolite has been used to perform cold-analysis (in Lab) on EVTX in multiple «real-life» situations. However, even if Zircolite has been used many times to perform analysis directly on a Microsoft Windows endpoint, there is not yet a pipeline to thoroughly test every release.

• All the code of the project is licensed under the GNU Lesser General Public License
• evtx_dump is under the MIT license
• The rules are released under the Detection Rule License (DRL) 1.0

About

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

Источник

How do I open an EVTX file in Linux?

EVTX files are Microsoft Event Viewer logs that can be viewed using Event Viewer. To launch Event Viewer hold Windows Button whilst pressing R and then type eventvwr. msc in Run window.

What is EVTX?

What is an EVTX file? Log file created by the Windows 7 Event Viewer; contains a list of events recorded by Windows; saved in a proprietary binary format that can only be viewed within the Event Viewer program.

How do I read an EVTX file in Python?

How to read . evtx file using python?

1. There is a module: pypi.python.org/pypi/python-evtx/0.5.0 maybe give this a try. – Nick H.
2. If access is denied, are you sure you are running your script at the right priv level? For example, your right click open with notepad will run it at lowest priv unless you UAC first.

How do I check event logs in Linux?

There are several ways to view logs in Linux: Access the directory cd/var/log . Specific log types are stored in subfolders under the log folder, for example, var/log/syslog . Use the dmseg command to browse through all system logs.

Where are EVTX files?

C:\windows\system32\
evtx files. The events of Windows event log are stored in . evtx files, and you can usually find them in C:\windows\system32\winevt\Logs .

How do I stop an EVTX file?

Disable the AppX Deployment Service using Registry Editor

1. WIN+R and type regedit.exe.
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Services\AppXSvc.
3. Change Start to 4.
4. This sets the service to Disabled.

Can I delete EVTX files?

evtx file is a permanent file and should not be deleted. You can clear the contents in the way I have previously described. If you clear the contents you can reduce the file size. The default file size is overgenerous unless you want to keep a log of events long past the time they remain relevant.

How do I use Event Log in Explorer?

With Event Log Explorer you can open event logs as event log files. To open an event log file, just select File / Open Log File. You can unite several event logs (or event log files) in one log view.

How do I parse XML in Python?

In order to parse XML document you need to have the entire document in memory.

1. To parse XML document.
2. Import xml.dom.minidom.
3. Use the function “parse” to parse the document ( doc=xml.dom.minidom.parse (file name);
4. Call the list of XML tags from the XML document using code (=doc.getElementsByTagName( “name of xml tags”)

How do I view syslog in Linux?

Linux logs can be viewed with the command cd/var/log, then by typing the command ls to see the logs stored under this directory. One of the most important logs to view is the syslog, which logs everything but auth-related messages.

How do I extract an EVTX file?

evtx files, and you can usually find them in C:\windows\system32\winevt\Logs . You can extract the events using FullEventLogView from . evtx files stored in your local system (As long as they are not locked and you have read permission) and from .

Источник

How to view .evtx files on Linux (Windows Event Log)

I have a .evtx (Windows Event Log) file, and want to view it on Linux.

• Free
• Easy to install/run
• Works on Linux
• Command line tools are OK, GUIs are OK

Unreplied Threads

How to externally execute a commands/scripts against the current scene rather than open a new blender window?

I am animator. My work consists of using 2D and 3D animtations together. For this reason, I recently installed blender soley for the grease pencil features.

I may exapnd my usage later on but right now I just want to get up and running.

I want to integrate blender into my existing toolset, so I can operate blender through the same interfaces I operate Maya and others tools with.

To do this, I essentially need a way to execute arbitrary Python code or blender commands externally.

The solutions I have across for Blender all lead to the creation of a new blender window when I execute them.

I want to target an already open blender scene, no different than manually invoking, say, Edit > Undo in a blender window.

In Maya I have a number of ways to do this. Command Ports being the ideal method.

Right now, I am really looking for quick and dirty way to get up and running. In Maya a quick way to execute externall Mel or Python code against an open scene is something like this:

Then in Maya define a hotkey to run the above code. Then through AutoHokey/PowerShell change the contents of the SomeCode.mel file and then trigger the hotkey. The code will be triggred in Maya as if it were manually invoked.

I am open to whatever method will get the job done. Thanks for any help.

How to remove the movement of Rigid Body elements?

I need to make an animation in which an object crawls out of the ground. To do this, I used Cell Fracture + Rigid Body. But the problem is that the elements of the ground move even if you don’t act on them. Is there any way to fix this?

What causes buildings to collapse in Battlebit Remastered?

Occasionally while playing Battlebit Remastered, buildings will collapse converting from a 1 or more story building into a ruins/rubble pile. This usually happens during extended firefights where there is a lot of RPG or Tank fire into the building. However it feels really random when the buildings collapse, sometimes a building can be taking RPG fire for a long time and nothing really happens other than some walls being destroyed, and other times that same building starts rumbling and collapses early in the fight.

It would be useful to know exactly what triggers the collapse, so that me or my squad could bring down certain buildings on purpose to make attacking or defending certain points easier.

In Battlebit Remastered what causes the destructible buildings to collapse?

Is it a total health pool of the building that needs to be reduced, specific destructible walls that need to be removed, a percentage of any destructible walls that need to be removed, or something else?

How much Piracy Supression do I need to secure a system?

Say I need to supress the piracy on system Zulei Cro:

I want to calculate the number of corvettes I need to have patrolling the system, but my math is somehow wrong.

So the system is currently unprotected because the Trade Value (65.16) is greater than the Piracy Suppression (0). So if I add 7 corvettes (7×10=70 Pirate supression) the system will be secured. Right?

Now look at this other system:

It has two corvettes (The Stream Fleet) patrolling for 20 Piracy Supression and the Trade Value is 52.48. So two corvettes are enough to supress the piracy on this system.

This tells me that the system Zulei Cro may need less than 7 corvettes to protect it.

• How can I calculate the Pirate Supression needed reliably?
• Does the Trade Protection provided by nearby stations affect the Pirate Supression formula somehow?

Источник