Download
Fibratus is a free, open-source Windows security monitoring tool designed for real-time threat detection, endpoint protection, and forensic analysis. It observes operating system activity through Windows Event Tracing to identify potentially malicious behavior. Its behavior-driven rule engine detects suspicious processes, file operations, network activity, and other security-relevant events. YARA integration enables memory scanning for malware signatures and suspicious patterns. Users can investigate system events, correlate activity, and develop custom detection rules. Captured events can be stored for forensic examination or forwarded to external monitoring systems. Python-based filaments extend the application with custom analysis and automation capabilities. Fibratus helps security analysts identify attacker techniques, investigate incidents, and strengthen Windows endpoint defenses.
Features
- Real-time Windows system event monitoring through Event Tracing for Windows
- Behavior-based threat detection using customizable security rules and event correlations
- YARA memory scanning for identifying malicious code and suspicious memory patterns
- Security event capture and forensic investigation with reusable event recordings
- Configurable event output pipelines for external monitoring and analysis systems
- Python filament extensions for custom threat detection, analysis, and automation
Project Samples
