add evtx yara scan

[lprat]

Add evtx scan yara

[hillu]

Oh, sorry. For some reason, Github did not show me your PRs and now I have made conflicting changes. :-(

I'm going to have a look anyway and see if I can fix them.