fibratus Files

Security sensor for realtime threat detection and protection

This is an exact mirror of the fibratus project, hosted at https://github.com/rabbitstack/fibratus. SourceForge is not affiliated with fibratus.

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
fibratus-2.3.0-slim-amd64.msi.sha256	2024-12-09	64 Bytes	0
fibratus-2.3.0-amd64.msi.sha256	2024-12-09	64 Bytes	0
fibratus-2.3.0-amd64.msi	2024-12-09	17.0 MB	0
fibratus-2.3.0-slim-amd64.msi	2024-12-09	9.6 MB	0
README.md	2024-12-09	6.7 kB	0
v2.3.0 source code.tar.gz	2024-12-09	11.0 MB	0
v2.3.0 source code.zip	2024-12-09	11.5 MB	0
Totals: 7 Items		49.1 MB	0

Release Notes

New features

#3acb68b: Eventlog alert sender
#fb4eac8: Augment process events with process flags
#bfdceb7: Augment process state with creation flags
#2511296: Add process creation flags filter fields
#6957a63: Persist process creation flags to capture
#4d62566: Add image.is_dotnet filter field
#b600df7: Add teb parameter and thread.teb_address filter field
#67fffab: Add additional file filter fields
#c66f028: Revamped YARA scanner
#9d1aa6a: MSI code signing

New rules

#a158eca: AppDomain Manager injection via CLR search order hijacking
#be05bab: .NET assembly loaded by unmanaged process
#9219478: Potential injection via .NET debugging
#aef70db: Hidden local account creation
#227ace7: DLL loaded via a callback function
#40cfe0a: Process execution from a self-deleting binary
#48be943: Image load via NTFS transaction
#3cbc71f: DLL loaded via APC queue
#b664239: Hidden registry key creation
#cb070a1: Clear Eventlog

Enhancements

#747b5f2: Bump Go from 1.21 to 1.23
#53b5457: Bump saferwall/pe from 1.4.4 to 1.5.4
#cb89ca5: Bump www.velocidex.com/golang/go-ntfs to latest version
#2f33b81: Add alert identifier
#c161273: Route saferwall/pe log messages to logrus
#dd0a1a6: Surface missing labels in rules validation subcommand
#14ed9a2: Expose StringShort methods for process/event types
#7847552: Launch systray server manually
#c5c131c: Disable CLR metadata parsing

Refactoring

#1ef56d8: Rename entrypoint parameter and thread.entrypoint filter field to start_address and thread.start_address respectively
#b4fb489: Rename pe.ps.child.file.name filter field to ps.child.pe.file.name
#84f301d: Unify ETW event processing pipeline
#1cab108: Move template rendering to email sender
#015e7f0: Generate Eventlog message compiler input file
#2f66468: Create a common eventlog package

Bug fixes

#98dc366: Solidify environment variable parsing from PEB
#8d2f6de: Correct the usage of the not operator on bool fields
#095f0dc: Slice NTFS data buffer
#1c5bd11: Avoid parsing an empty PE byte buffer
#c78eb4b: Prevent loading malformed YAML configuration
#7ccfa70: Fix parsing of image file characteristics
#f7e8dc5: Skip reading hidden registry key value
#b69ade4: Release file only by file object
#a8dc8da: Panic redirection to logs

Breaking changes

YARA configuration settings were restructured as per commit leading to removal of some properties

Source: README.md, updated 2024-12-09

Other Useful Business Software

$300 Free Credits to Build on Google Cloud Icon

$300 Free Credits to Build on Google Cloud

New customers can spin up VMs, build with AI, and query data at no cost.

Put your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.

Start Free

Veeam Data Platform v13.1 - Get Your Free Trial Icon

Veeam Data Platform v13.1 - Get Your Free Trial

Secure by design, portable by default. Recover clean, fast, anywhere. Start a free trial.

Try Veeam Data Platform today. Experience the unified platform that's secure by design, portable by default, and proven to recover clean, fast, and anywhere.

Try it Free

$300 Free Credits to Build on Google Cloud

New customers can spin up VMs, build with AI, and query data at no cost.

Put your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.

Start Free

Recommended Projects

Wazuh
The Open Source Security Platform
AlienVault OSSIM
Open Source SIEM
Device Activity Tracker
A phone number can reveal whether a device is active
Simple Event Correlator
Simple Event Correlator (SEC) is a lightweight event correlator for network management, log file monitoring, security management, fraud detection, and other tasks which involve event correlation.
Security Datasets
Re-play Security Events