https://cybertoolchain.io/tools/fibratus New releases and features in Fibratus, tracked by The Cyber Toolchain. en Wed, 12 Aug 2026 11:56:08 GMT https://github.com/rabbitstack/fibratus/releases/tag/v3.1.0 https://github.com/rabbitstack/fibratus/releases/tag/v3.1.0 Wed, 12 Aug 2026 11:56:08 GMT Fibratus v3.1.0 adds kernel callstack enrichment, smart event filtering with approvers, and 11 new detection rules • Introduces a kernel thread callstack summary filter field, resolving kernel return addresses to their corresponding driver modules and stitching callstack data to events via timestamps for more reliable callstack-based filtering and detection. • Adds smart event filtering with approvers, dynamically evaluating and discarding events before they propagate through the full processing pipeline to substantially reduce processing volume while preserving detection-relevant events. • Adds 11 new detection rules covering lateral movement, defense evasion, credential access, and suspicious DLL-loading techniques — including 'Untrusted DLL loaded from masqueraded Windows directory', 'Suspicious LSASS process access', 'Potential privilege elevation via arbitrary section creation', 'CldApi DLL loaded by an unusual process', 'BindFlt DLL loaded by an unusual process', 'Direct disk device access', 'Suspicious registry symbolic link creation', 'Activation Context memory section hijacking', 'Untrusted DLL loaded from unusual directory', 'Sensitive registry hive dump', and 'Potential operation evasion via direct syscall'. • Overhauled the digital signature verification pipeline with improved async verification, better cache keying, eager metadata-store initialization, and more robust handling of freshly added signatures. • Delivers filtering and approver pipeline performance improvements including pattern precompilation, path string interning, object pooling, cached filter values, and more efficient wildcard matching. Breaking changes: • Malicious/vulnerable driver filter fields have been removed, along with their associated detection rules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fibratus https://github.com/rabbitstack/fibratus/releases/tag/v2.4.0 https://github.com/rabbitstack/fibratus/releases/tag/v2.4.0 Tue, 20 May 2025 17:23:05 GMT Fibratus v2.4.0 adds 24 new detection rules, callstack coverage for VirtualAlloc/OpenProcess/OpenThread, new filter operators, and a match-all rule engine strategy. • Adds callstack telemetry for `VirtualAlloc`, `OpenProcess`, and `OpenThread` events, enabling stack-aware detection of memory and handle abuse. • Introduces `*.path` filter fields (`registry.path`, `image.path`, `file.path`) for matching full path values in filter expressions. • New `intersects` operator for filter expressions to check set intersection between field values. • New `foreach` function for iterating over pseudo fields such as `ps._ancestors`, `ps._modules`, and `pe._sections` in rule conditions. • Adds `CreateSymbolicLinkObject` event type for detecting object-level symbolic link creation. • Incorporates thread pool event telemetry and exposes corresponding thread pool filter fields. • Adds thread start address symbol and module filter fields for richer thread-origin detection. • Adds additional callstack filter fields for deeper stack inspection in rules. • Introduces `match-all` rule engine strategy to evaluate every matching rule rather than stopping at the first match. • New `isolate` rule action for isolating a host when a rule fires. • Adds 24 new built-in detection rules covering LSASS dumping, ClickFix infection chains, DLL side-loading, shellcode via ETW, WMI abuse from Office, Windows Defender tampering, suspicious print processors, Vault client DLL loads, XSL/HTA script execution, and more. • Extends `substr` function with an optional argument for more flexible string slicing in filter expressions. Breaking changes: • `registry.key`, `image.name`, and `file.name` now yield only the base name. Use `registry.path`, `image.path`, or `file.path` to obtain the full path. • `ps.ancestor` indexed-field now always returns the ancestor process name for the given level; use the `foreach` function with `ps._ancestors` to evaluate other process attributes. • `ps.modules` field has been removed; use the `foreach` function with `ps._modules` to evaluate module attributes. • `ps.pe.sections` field has been removed; use the `foreach` function with `pe._sections` to evaluate section attributes. • Callstack index fields `ustart`, `uend`, `kstart`, and `kend` have been removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fibratus https://github.com/rabbitstack/fibratus/releases/tag/v2.3.0 https://github.com/rabbitstack/fibratus/releases/tag/v2.3.0 Mon, 09 Dec 2024 12:32:12 GMT Fibratus v2.3.0 adds an Eventlog alert sender, 10 new detection rules, richer process/thread/file filter fields, and a revamped YARA scanner. • Adds an Eventlog alert sender so rule detections can be forwarded directly to the Windows Event Log. • Augments process events and state with process creation flags for richer behavioural context. • Adds `ps.creation_flags` filter fields to write rules against process creation flag combinations. • Adds `image.is_dotnet` filter field to detect .NET image loads in filter expressions. • Adds `teb` parameter and `thread.teb_address` filter field to expose Thread Environment Block address in thread events. • Adds additional file filter fields for finer-grained file event filtering. • Revamps the YARA scanner with restructured configuration. • New detection rule: AppDomain Manager injection via CLR search order hijacking. • New detection rule: .NET assembly loaded by an unmanaged process. • New detection rule: Potential injection via .NET debugging. • New detection rule: Hidden local account creation. • New detection rule: DLL loaded via a callback function. • New detection rule: Process execution from a self-deleting binary. • New detection rule: Image load via NTFS transaction. • New detection rule: DLL loaded via APC queue. • New detection rule: Hidden registry key creation. • New detection rule: Clear Eventlog. • Surfaces missing labels in the rules validation subcommand output. • Adds alert identifier to alert payloads. • Adds option to disable CLR metadata parsing. Breaking changes: • YARA configuration settings were restructured and some properties were removed — existing YARA config blocks must be updated to match the new layout. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fibratus https://github.com/rabbitstack/fibratus/releases/tag/v2.2.1 https://github.com/rabbitstack/fibratus/releases/tag/v2.2.1 Fri, 13 Sep 2024 15:44:28 GMT Fibratus v2.2.1 adds event dumping on rule matches, a new `open_remote_thread` macro, and an improved driver-drop detection rule. • Dumps full event details in rule match output for richer forensic context. • Introduces `open_remote_thread` rule macro for detecting cross-process thread injection. • Improves `Vulnerable or malicious driver dropped` detection rule coverage. • Reduces false positives in `Potential SAM hive dumping` and `Unsigned DLL injection via remote thread` rules. • Displays Fibratus version in log output for easier triage and support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fibratus https://github.com/rabbitstack/fibratus/releases/tag/v1.10.0 https://github.com/rabbitstack/fibratus/releases/tag/v1.10.0 Fri, 31 Mar 2023 21:57:45 GMT Fibratus v1.10.0 adds `yara` filter function, `kevt.arg` generic field, `process.uuid`, and sequence rule grammar. • `yara` filter function enables signature-based detection logic within filter rules • `kevt.arg` filter field extracts arbitrary event parameters by internal name • `process.uuid` filter field provides a repetition-resistant identifier for processes • Support for new `sequence` rule grammar and aliases in place of decommissioned sequence policy types Breaking changes: • The previous sequence policy types are no longer supported; existing rules must be migrated to the `sequence` rule format. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fibratus https://github.com/rabbitstack/fibratus/releases/tag/v1.8.0 https://github.com/rabbitstack/fibratus/releases/tag/v1.8.0 Wed, 30 Nov 2022 15:55:14 GMT Fibratus v1.8.0 adds driver load detection, macro expansion, case-insensitive filters, and email alert enhancements • `driver` object type now generates KEvents for driver load events • initial catalog of MITRE ATT&CK detection rules is included by default • macro expansion allows variable substitution in rule definitions • HTML formatting supported for alert emails via the email alert sender • Audit API Calls and Antimalware Engine ETW providers can now be enabled/disabled individually • handle events include `Driver` image path enrichment for driver object types • new `ps.sibling.args` filter field to match sibling process arguments • field interpolation in alert title/text supports Markdown/HTML syntax • `~=` operator enables case-insensitive string comparison in filters • `is_minidump` filter function checks minidump file signatures Breaking changes: • Rule policies with the `selector` attribute will fail to load; remove it and include conditions as the first rule condition. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fibratus https://github.com/rabbitstack/fibratus/releases/tag/v1.6.0 https://github.com/rabbitstack/fibratus/releases/tag/v1.6.0 Wed, 31 Aug 2022 17:51:02 GMT Fibratus v1.6.0 adds stateful runtime detections, field filters for files/handles, and raw ETW parsing with performance gains • `--kstream.raw-event-parsing=true` enables raw ETW event parsing to unlock 10x performance gains. • `stateful-event-tracking` in rules allows new stateful runtime detections. • Field filters are now available for file attributes/status parameters and handle object parameters. Breaking changes: • File and handle object parameters are represented in decimal instead of hex format when `--kstream.raw-event-parsing=true` is used. • Event exclusions by process name now require case-sensitive image names. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fibratus https://github.com/rabbitstack/fibratus/releases/tag/v1.5.0 https://github.com/rabbitstack/fibratus/releases/tag/v1.5.0 Fri, 29 Apr 2022 13:59:06 GMT Fibratus v1.5.0 adds OpenProcess and OpenThread events, eventlog and HTTP outputs, and new process filter fields • `OpenProcess` and `OpenThread` events are now available for tracking process and thread handle operations • New `eventlog` output allows writing traces to the Windows Event Log • New `http` output supports sending traces over HTTP • `ps.sibling.*`, `ps.domain`, and `ps.username` filter fields are added to support process filtering by sibling processes, domain, and username Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fibratus https://github.com/rabbitstack/fibratus/releases/tag/v1.4.2 https://github.com/rabbitstack/fibratus/releases/tag/v1.4.2 Sat, 25 Dec 2021 20:59:57 GMT Fibratus v1.4.2 adds YARA rule match injection as event metadata tags • Injects YARA rules matches into event metadata tags Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fibratus