Zircolite

Repository description, written by its ownerA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

Active last commit today

Commits in 26 of the last 52 weeks

Category: Incident response
Subcategory: Log Analysis Tools
License: Other (GitHub could not identify it)
Latest release: Release v4.6.0, Oct 18, 2026 (checksum file only, no signature)
Stars: 863
GitHub repository id: 343939740
Listed in: awesome-incident-response (Apache-2.0)
Last checked: Oct 19, 2026

Security advisories

Advisories the maintainers published on GitHub. Vulnerabilities reported only elsewhere, for example in the NVD, are not included.

GHSA-vhhg-j629-5552 Medium Oct 3, 2026
Rich markup injection from evidence content aborts a Zircolite run and spoofs console output
GHSA-9vjj-w2rg-2m48 Medium Oct 3, 2026
Split field names taken from log values overwrite event fields and row_id (detection evasion, analysis denial of service)
GHSA-f5jh-7mx7-wwrq Medium Oct 3, 2026
ZircoGui data template lets a log field override the rule title, level, file and description
GHSA-r5c4-46jg-wgjh Medium Oct 3, 2026
DOM XSS in the bundled ZircoGui (Mini-GUI) via log-controlled field names, values and titles
GHSA-42q5-fmjv-w4px Medium Oct 3, 2026
Unbounded regex backtracking in the SQLite `regexp` function lets one crafted log line stall a Zircolite run (ReDoS)
GHSA-2hq2-3w3j-6pc9 Low Oct 3, 2026
--generate-config follows a symlink planted at the output path (check-then-open TOCTOU)
GHSA-95jp-m2hj-j5mf Low Oct 3, 2026
CSV formula injection through the header row of `--csv` detection reports
GHSA-q2qh-vgfr-h3q9 Low Oct 3, 2026
Quadratic regex backtracking in auditd line parsing (ReDoS)
GHSA-rxv3-q96p-qqwh Low Oct 3, 2026
7-Zip log-type auto-detection decompresses the whole first member into memory (decompression bomb)
GHSA-f8r2-xpcw-c4gh Low Oct 3, 2026
Archive password can only be passed on the command line, exposing it to other local users
GHSA-m3h8-pcx6-6wqx High Oct 3, 2026
Transform sandbox escape: config-supplied transform code runs with full interpreter privileges