Evtx

Windows Events Attack SamplesHTML

A collection of 200 Windows EVTX event log samples mapped to MITRE ATT&CK techniques for detection testing and threat hunting.

ZircolitePython

A standalone Python tool for applying SIGMA detection rules to EVTX, Auditd, Sysmon for Linux, and other log formats.

EVTXtractPython

Recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.