Fibratus

No entries match these filters. Clear filters

1. v3.1.0 Aug 12, 2026 · issue 043

   Fibratus v3.1.0 adds kernel callstack enrichment, smart event filtering with approvers, and 11 new detection rules

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.1.0 https://github.com/rabbitstack/fibratus.git
   # already have the repo? check out this version:
   $ git checkout v3.1.0

   • Introduces a kernel thread callstack summary filter field, resolving kernel return addresses to their corresponding driver modules and stitching callstack data to events via timestamps for more reliable callstack-based filtering and detection.
   • Adds smart event filtering with approvers, dynamically evaluating and discarding events before they propagate through the full processing pipeline to substantially reduce processing volume while preserving detection-relevant events.
   • Adds 11 new detection rules covering lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access., defense evasion, credential access, and suspicious DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls.-loading techniques — including 'Untrusted DLL loaded from masqueraded Windows directory', Suspicious LSASS process access, 'Potential privilege elevation via arbitrary section creation', 'CldApi DLL loaded by an unusual process', 'BindFlt DLL loaded by an unusual process', Direct disk device access, Suspicious registry symbolic link creation, Activation Context memory section hijacking, Untrusted DLL loaded from unusual directory, Sensitive registry hive dump, and Potential operation evasion via direct syscall.
   • Overhauled the digital signature verification pipeline with improved async verification, better cache keying, eager metadata-store initialization, and more robust handling of freshly added signatures.
   • Delivers filtering and approver pipeline performance improvements including pattern precompilation, path string interning, object pooling, cached filter values, and more efficient wildcard matching.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Malicious/vulnerable driver filter fields have been removed, along with their associated detection rules.
2. v3.0.0 Apr 22, 2026 · release notes

   Fibratus v3.0.0 adds direct/indirect syscall evasion detection, process token enrichment, 50+ new rules, and JSON Eventlog alerts.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.0 https://github.com/rabbitstack/fibratus.git
   # already have the repo? check out this version:
   $ git checkout v3.0.0

   • Adds direct and indirect syscall evasion scanners to detect malware bypassing defenses via syscall abuse.
   • Enriches events with process access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. details including integrity level and elevation type.
   • Ships 50+ curated detection rules covering privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., defense evasion, and execution tactics.
   • Adds color-coded console output to distinguish event types, parameters, and fields at a glance.
   • Supports emitting alerts to the Windows Event Log in structured JSON format for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. and log pipeline integration.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The ps.child.* filter fields are removed; migrate to ps.* fields instead.
   • !The LoadImage and UnloadImage events are renamed to LoadModule and UnloadModule.
   • !The registry.value field now returns the value name instead of the value data; use registry.data to obtain the value data.
3. v2.4.0 May 20, 2025 · release notes

   Fibratus v2.4.0 adds 24 new detection rules, callstack coverage for VirtualAlloc/OpenProcess/OpenThread, new filter operators, and a match-all rule engine strategy.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.4.0 https://github.com/rabbitstack/fibratus.git
   # already have the repo? check out this version:
   $ git checkout v2.4.0

   └──▷ TRY IT
   Use foreach with ps._ancestors to check any ancestor process name, replacing the removed ps.ancestor indexed lookups for multi-level chain detection.
   copy

   $ fibratus run --filter "foreach(ps._ancestors, $a, $a.name = 'winword.exe')"

   • Adds callstack telemetry for VirtualAlloc, OpenProcess, and OpenThread events, enabling stack-aware detection of memory and handle abuse.
   • Introduces *.path filter fields (registry.path, image.path, file.path) for matching full path values in filter expressions.
   • New intersects operator for filter expressions to check set intersection between field values.
   • New foreach function for iterating over pseudo fields such as ps._ancestors, ps._modules, and pe._sections in rule conditions.
   • Adds CreateSymbolicLinkObject event type for detecting object-level symbolic link creation.

   +7 more show less

   • Incorporates thread pool event telemetry and exposes corresponding thread pool filter fields.
   • Adds thread start address symbol and module filter fields for richer thread-origin detection.
   • Adds additional callstack filter fields for deeper stack inspection in rules.
   • Introduces match-all rule engine strategy to evaluate every matching rule rather than stopping at the first match.
   • New isolate rule action for isolating a host when a rule fires.
   • Adds 24 new built-in detection rules covering LSASS dumping, ClickFix infection chains, DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. side-loading, shellcode via ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors., WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. abuse from Office, Windows Defender tampering, suspicious print processors, Vault client DLL loads, XSL/HTA script execution, and more.
   • Extends substr function with an optional argument for more flexible string slicing in filter expressions.

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !registry.key, image.name, and file.name now yield only the base name. Use registry.path, image.path, or file.path to obtain the full path.
   • !ps.ancestor indexed-field now always returns the ancestor process name for the given level; use the foreach function with ps._ancestors to evaluate other process attributes.
   • !ps.modules field has been removed; use the foreach function with ps._modules to evaluate module attributes.
   • !ps.pe.sections field has been removed; use the foreach function with pe._sections to evaluate section attributes.
   • !Callstack index fields ustart, uend, kstart, and kend have been removed.
4. v2.3.0 Dec 9, 2024 · release notes

   Fibratus v2.3.0 adds an Eventlog alert sender, 10 new detection rules, richer process/thread/file filter fields, and a revamped YARA scanner.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.3.0 https://github.com/rabbitstack/fibratus.git
   # already have the repo? check out this version:
   $ git checkout v2.3.0

   • Adds an Eventlog alert sender so rule detections can be forwarded directly to the Windows Event Log.
   • Augments process events and state with process creation flags for richer behavioural context.
   • Adds ps.creation_flags filter fields to write rules against process creation flag combinations.
   • Adds image.is_dotnet filter field to detect .NET image loads in filter expressions.
   • Adds teb parameter and thread.teb_address filter field to expose Thread Environment Block address in thread events.

   +15 more show less

   • Adds additional file filter fields for finer-grained file event filtering.
   • Revamps the YARA scanner with restructured configuration.
   • New detection rule: AppDomain Manager injection via CLR search order hijacking.
   • New detection rule: .NET assembly loaded by an unmanaged process.
   • New detection rule: Potential injection via .NET debugging.
   • New detection rule: Hidden local account creation.
   • New detection rule: DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. loaded via a callback function.
   • New detection rule: Process execution from a self-deleting binary.
   • New detection rule: Image load via NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. transaction.
   • New detection rule: DLL loaded via APC queue.
   • New detection rule: Hidden registry key creation.
   • New detection rule: Clear Eventlog.
   • Surfaces missing labels in the rules validation subcommand output.
   • Adds alert identifier to alert payloads.
   • Adds option to disable CLR metadata parsing.

   20 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !YARA configuration settings were restructured and some properties were removed — existing YARA config blocks must be updated to match the new layout.
5. v2.2.1 Sep 13, 2024 · release notes

   Fibratus v2.2.1 adds event dumping on rule matches, a new open_remote_thread macro, and an improved driver-drop detection rule.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.2.1 https://github.com/rabbitstack/fibratus.git
   # already have the repo? check out this version:
   $ git checkout v2.2.1

   • Dumps full event details in rule match output for richer forensic context.
   • Introduces open_remote_thread rule macro for detecting cross-process thread injection.
   • Improves Vulnerable or malicious driver dropped detection rule coverage.
   • Reduces false positives in Potential SAM hive dumping and Unsigned DLL injection via remote thread rules.
   • Displays Fibratus version in log output for easier triage and support.

   5 details in Everything

6. v2.2.0 Sep 4, 2024 · release notes

   Fibratus v2.2.0 adds kernel callstack enrichment, loldrivers detection, SetThreadContext events, and 26 new detection rules.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.2.0 https://github.com/rabbitstack/fibratus.git
   # already have the repo? check out this version:
   $ git checkout v2.2.0

   └──▷ TRY IT
   List every rule currently loaded by Fibratus to audit your active detection coverage.
   copy

   $ fibratus rules list

   • New pe.is_modified filter field enables detection of PE header tampering in memory.
   • New NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. parser reads file data via raw device access, bypassing standard I/O.
   • New SetThreadContext event surfaces thread context manipulation activity.
   • Detects vulnerable and malicious drivers using the loldrivers dataset.
   • Kernel stack enrichment annotates process, file, thread, registry, and DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. events with call stack frames.

   +11 more show less

   • New callstack filter fields for writing rules that inspect kernel/user-mode call stacks.
   • New Systray alert sender delivers alerts via Windows system tray notifications.
   • Event forwarding mode allows Fibratus to run as a pure forwarder without local rule evaluation.
   • New rules validate CLI command enables automated rule validation in CI pipelines.
   • New rules list CLI command displays all loaded detection rules.
   • New rule template CLI command scaffolds new detection rule files.
   • New min-engine-version attribute in detection rules enforces minimum Fibratus version compatibility.
   • Adds 26 new out-of-the-box detection rules covering process injection, DLL side-loading, persistence, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., LSASS abuse, Office macro execution, and more.
   • New configuration flag permits disabling the rule engine entirely.
   • Dynamic event enablement inspects the loaded rule set and activates only required kernel event providers.
   • System providers support runs specific providers in separate tracing sessions.

   16 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Detection rules layout has changed from group-based to individual files; certain attributes changed and new mandatory attributes were added — all existing rules must be migrated to the new format.
7. v2.0.0 Sep 1, 2023 · release notes

   Fibratus v2.0.0 adds VirtualAlloc/VirtualFree/MapViewFile/DuplicateHandle/RegCloseKey/DNS telemetry events and image signature filtering

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.0 https://github.com/rabbitstack/fibratus.git
   # already have the repo? check out this version:
   $ git checkout v2.0.0

   • Adds VirtualAlloc and VirtualFree kernel events to track memory allocation activity
   • Adds MapViewFile and UnmapViewFile kernel events plus mapped-files state for tracking file mappings
   • Adds DuplicateHandle event to detect handle duplication across processes
   • Adds DNS telemetry via QueryDns and ReplyDns events for monitoring DNS queries and responses
   • Adds RegCloseKey event to capture registry key closure operations

   +3 more show less

   • Exposes image signature information through image.signature.type and image.signature.level filter fields
   • Expands pe filter field set with new parameters allowing lazy value extraction for Portable Executable analysis
   • Enables bare boolean expressions in filters for more flexible event querying

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The sid parameter and the ps.sid filter fields contain the raw SID value instead of the username/domain tuple
   • !Command line parameters and filter fields contain the original, unexpanded command line
   • !operation parameter name in the CreateFile event is renamed to create_disposition
   • !comm parameter name in process events is renamed to cmdline
   • !Convert flags event parameters to uppercase strings
   • !share_mask parameter contains the full permission name, e.g. READ|WRITE|DELETE
8. v1.10.0 Mar 31, 2023 · release notes

   Fibratus v1.10.0 adds yara filter function, kevt.arg generic field, process.uuid, and sequence rule grammar.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.10.0 https://github.com/rabbitstack/fibratus.git
   # already have the repo? check out this version:
   $ git checkout v1.10.0

   • yara filter function enables signature-based detection logic within filter rules
   • kevt.arg filter field extracts arbitrary event parameters by internal name
   • process.uuid filter field provides a repetition-resistant identifier for processes
   • Support for new sequence rule grammar and aliases in place of decommissioned sequence policy types

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The previous sequence policy types are no longer supported; existing rules must be migrated to the sequence rule format.
9. v1.8.0 Nov 30, 2022 · release notes

   Fibratus v1.8.0 adds driver load detection, macro expansion, case-insensitive filters, and email alert enhancements

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.8.0 https://github.com/rabbitstack/fibratus.git
   # already have the repo? check out this version:
   $ git checkout v1.8.0

   • driver object type now generates KEvents for driver load events
   • initial catalog of MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. detection rules is included by default
   • macro expansion allows variable substitution in rule definitions
   • HTML formatting supported for alert emails via the email alert sender
   • Audit API Calls and Antimalware Engine ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. providers can now be enabled/disabled individually

   +5 more show less

   • handle events include Driver image path enrichment for driver object types
   • new ps.sibling.args filter field to match sibling process arguments
   • field interpolation in alert title/text supports Markdown/HTML syntax
   • ~= operator enables case-insensitive string comparison in filters
   • is_minidump filter function checks minidump file signatures

   10 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Rule policies with the selector attribute will fail to load; remove it and include conditions as the first rule condition.
10. v1.6.0 Aug 31, 2022 · release notes

    Fibratus v1.6.0 adds stateful runtime detections, field filters for files/handles, and raw ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. parsing with performance gains

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/rabbitstack/fibratus.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    └──▷ HOW TO FIND IT
    Write a rule using the new stateful event tracking feature to correlate events over time.
    📍# Rule definition example name: MyStatefulRule type: stateful-event-tracking ...
    • --kstream.raw-event-parsing=true enables raw ETW event parsing to unlock 10x performance gains.
    • stateful-event-tracking in rules allows new stateful runtime detections.
    • Field filters are now available for file attributes/status parameters and handle object parameters.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !File and handle object parameters are represented in decimal instead of hex format when --kstream.raw-event-parsing=true is used.
    • !Event exclusions by process name now require case-sensitive image names.
11. v1.5.0 Apr 29, 2022 · release notes

    Fibratus v1.5.0 adds OpenProcess and OpenThread events, eventlog and HTTP outputs, and new process filter fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/rabbitstack/fibratus.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    • OpenProcess and OpenThread events are now available for tracking process and thread handle operations
    • New eventlog output allows writing traces to the Windows Event Log
    • New http output supports sending traces over HTTP
    • ps.sibling.*, ps.domain, and ps.username filter fields are added to support process filtering by sibling processes, domain, and username

    4 details in Everything

12. v1.4.2 Dec 25, 2021 · release notes

    Fibratus v1.4.2 adds YARA rule match injection as event metadata tags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.2 https://github.com/rabbitstack/fibratus.git
    # already have the repo? check out this version:
    $ git checkout v1.4.2

    • Injects YARA rules matches into event metadata tags

    1 detail in Everything

13. v1.4.1 Sep 18, 2021 · release notes

    Fibratus v1.4.1 adds PE resource field aliases and event rule metadata integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.1 https://github.com/rabbitstack/fibratus.git
    # already have the repo? check out this version:
    $ git checkout v1.4.1

    • Pushes matched rule tags into event metadata via event.rule.metadata.tags

    1 detail in Everything

14. v1.4.0 Aug 24, 2021 · release notes

    Fibratus v1.4.0 adds rule support, fuzzy operators, process ancestry filtering, filament arguments, and thread PID matching

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/rabbitstack/fibratus.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Adds rules configuration to define detection logic for Filaments.
    • Adds fuzzy matching operators (ifuzzy, fuzzynorm, nifuzzy) for string filters.
    • Adds process ancestry filtering capability for path-based events.
    • Enables passing arguments to filaments during execution.
    • Adds exe parameter to CreateThread events.

    +1 more show less

    • Adds thread.pid filter field for matching the target thread's process id.

    6 details in Everything

15. v1.2.0 Apr 27, 2021 · release notes

    Fibratus v1.2.0 adds reverse DNS lookups, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network./MD5 filter functions, and new fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/rabbitstack/fibratus.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    └──▷ TRY IT
    Use string matching operators to filter events based on file extension or process name.
    copy

    $ matches(file.extension, '*.exe') and imatches(process.name, 'cmd')

    Negate a condition using the new unary operator to exclude specific traffic.
    copy

    $ not matches(dip.names, '10.0.0.0/8')

    • Adds cidr_contains and md5 function support in filters
    • Adds dip.names, sip.names, and file.extension filter fields
    • Adds unary not operator to filters
    • Adds matches and imatches string matching operators

    4 details in Everything

16. v0.6.0 Jan 22, 2017 · release notes

    Fibratus v0.6.0 adds GIL-free kernel event collection, PE metadata registry, and multi-sink streaming

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0 https://github.com/rabbitstack/fibratus.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0

    • Implements a high performance GIL-free kernel event stream collector
    • Adds image_meta registry providing PE headers, sections, imports, and file information
    • Enables streaming kernel events to multiple output sinks simultaneously

    3 details in Everything

17. v0.4.0 Nov 1, 2016 · release notes

    Fibratus v0.4.0 adds --pid flag, config-based process exclusion, and ElasticSearch output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/rabbitstack/fibratus.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    • Adds --pid command line flag for per-process spying
    • Enables excluding processes from the trace through the configuration file
    • Adds ElasticSearch output adapter

    3 details in Everything