# Fibratus

> Runtime threat detection, protection, and eradication for Windows.

Fibratus is an open-source security engine that captures kernel-level telemetry via ETW (Event Tracing for Windows) and analyzes it using behavior-driven detection rules and YARA memory scanning. It detects, blocks, and eradicates advanced adversary tradecraft in real time.

## Pages

- [Home](/): Runtime threat detection, protection, and eradication for Windows.
- [How It Works](/how-it-works): Architecture and execution model end-to-end.
- [Kernel Runtime Security](/kernel-runtime-security): Kernel-level event capture via ETW.
- [Behavioral Detection](/behavioral-detection): Behavior-driven rules over kernel telemetry.
- [Detection Engineering](/detection-engineering): Author, test, and ship detections.
- [Product Overview](/product/overview): Product capabilities and components.
- [Extensibility](/product/extensibility): Filaments, outputs, and custom logic.
- [Downloads](/downloads): Download the latest Fibratus release.
- [Roadmap](/roadmap): Upcoming features and direction.
- [Changelog](/changelog): Release notes and version history.
- [Detection Rules](/rules): Library of behavioral detection rules.
- [Documentation](/docs): Setup, configuration, and reference.
- [Glossary](/glossary): Windows internals and detection terminology.
- [Blog](/blog): Research, detection notes, and engineering posts.
- [About / Mission](/about/mission): Why Fibratus exists.
- [Team](/about/team): Engineers and contributors.
- [Open Source](/about/open-source): Apache 2.0 licensing and contribution.
- [Contact](/contact): Get in touch.

## Key Facts

- License: Apache 2.0
- Language: Go
- Platform: Windows 10, Windows 11, Windows Server
- Creator: Nedim Šabić (@rabbitstack)
- GitHub: https://github.com/rabbitstack/fibratus
- Website: https://fibratus.io

## Core Capabilities

- Kernel-level event capture via ETW (process, thread, file, registry, network, memory, handle, driver, image load)
- Behavior-driven detection rules in YAML with MITRE ATT&CK mapping
- YARA memory scanning for in-memory threat detection
- Live process tree with ancestry tracking and execution context
- Sequence-based rules for multi-stage attack correlation
- Automated threat blocking and process termination
- Python-based filament plugins for custom logic and integrations
- Output sinks: Elasticsearch, AMQP/RabbitMQ, HTTP webhooks, Windows Event Log

## Architecture

Fibratus operates entirely in user-space (no kernel driver required). Events flow through a pipeline: collection → enrichment → rule evaluation → response/output. The enrichment stage maintains a live process tree, correlates events with process ancestry, loaded modules, and handles.

## Documentation

- Getting Started: https://fibratus.io/docs/setup/installation
- Detection Rules: https://fibratus.io/docs/filters-and-rules
- CLI Reference: https://fibratus.io/docs/cli
- Outputs: https://fibratus.io/docs/outputs
- Filaments (Plugins): https://fibratus.io/docs/filaments
- YARA Scanning: https://fibratus.io/docs/yara
- PE Introspection: https://fibratus.io/docs/pe
- Events Reference: https://fibratus.io/docs/events
- Alerts: https://fibratus.io/docs/alerts
- Captures: https://fibratus.io/docs/captures
- Transformers: https://fibratus.io/docs/transformers

## Architecture Hubs

- How Fibratus Works: https://fibratus.io/how-it-works
- Kernel Runtime Security: https://fibratus.io/kernel-runtime-security
- Behavioral Detection: https://fibratus.io/behavioral-detection
- Detection Engineering: https://fibratus.io/detection-engineering

## Solutions by Role

- Blue Team: https://fibratus.io/solutions/blue-team
- Red Team: https://fibratus.io/solutions/red-team
- Purple Team: https://fibratus.io/solutions/purple-team
- Detection Engineers: https://fibratus.io/solutions/detection-engineers
- SOC Analysts: https://fibratus.io/solutions/soc-analysts
- Threat Hunters: https://fibratus.io/solutions/threat-hunters

## Resources

- Detection Rules Library: https://fibratus.io/rules
- Security Glossary: https://fibratus.io/glossary
- Blog: https://fibratus.io/blog
- Downloads: https://fibratus.io/downloads
- Changelog: https://fibratus.io/changelog
- Roadmap: https://fibratus.io/roadmap

## Platform Complement Series

Technical articles explaining how Fibratus complements existing security platforms as an endpoint-native runtime rule layer.

- How Fibratus Complements Sysmon: https://fibratus.io/blog/how-fibratus-complements-sysmon — Adding behavior-driven detection to high-value Windows telemetry
- How Fibratus Complements Microsoft Defender: https://fibratus.io/blog/how-fibratus-complements-microsoft-defender — Adding runtime-native detection logic where event visibility already exists
- How Fibratus Complements CrowdStrike Falcon: https://fibratus.io/blog/how-fibratus-complements-crowdstrike — Adding explicit runtime rules alongside Falcon's IOA model
- How Fibratus Complements Elastic Security: https://fibratus.io/blog/how-fibratus-complements-elastic — Adding endpoint-native runtime rules alongside EQL correlation
- How Fibratus Complements Splunk Enterprise Security: https://fibratus.io/blog/how-fibratus-complements-splunk — Adding endpoint-native runtime logic alongside correlation searches and risk-based alerting

## Extended Context

- Full technical details: https://fibratus.io/llms-full.txt