Fibratus
A Windows security tool for real-time adversary tradecraft detection, memory scanning, and forensics via behavior-driven rules.
What is Fibratus?
Fibratus is a Windows security tool that detects, protects against, and hunts advanced adversary tradecraft by analyzing system events in real-time. It uses a behavior-driven rule engine and YARA memory scanning to identify malicious activities, and supports forensic analysis through event capture. The tool helps security teams monitor, alert, and investigate threats on Windows environments.
Security professionals, incident responders, and threat hunters working on Windows systems who need real-time detection and forensic capabilities. It is also suitable for blue teams and SOC analysts focused on adversary hunting and tradecraft analysis.
Developers choose Fibratus for its integrated approach combining real-time behavior detection, memory scanning, and forensics in a single tool. Its extensibility via Python filaments and customizable rule engine allows for tailored security monitoring, making it a versatile alternative to commercial endpoint detection solutions.
Overview
Adversary tradecraft detection, protection, and hunting
Use Cases
Best For
- Real-time detection of adversary tradecraft on Windows systems
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
