rabbitstack/fibratus

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

2537 stars · 220 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Fibratus is a Windows security sensor that performs realtime threat detection by analyzing kernel and system telemetry (including ETW events) against a behavior-driven rule engine and YARA memory scanner. It supports routing events to output sinks, writing capture files for forensics, and extending functionality via Python-based filaments.

Use cases

• detect malware and attacker tradecraft on windows endpoints in realtime
• monitor process, file, registry and network activity via etw telemetry
• write behavioral detection rules mapped to mitre attack techniques
• scan process memory with yara for malicious payloads
• capture system events for forensic analysis
• forward security events to a siem or output sinks
• extend detection tooling with python filaments

When to choose

• you need an open-source edr-style sensor for windows hosts
• you want kernel-level telemetry with a flexible rule engine
• you need memory scanning and event capture for forensics on windows

When to avoid

• you need threat detection on linux or macos
• you want a fully managed commercial edr with vendor support
• your focus is network-only intrusion detection rather than endpoint telemetry

Facets

application · maturity active

security monitoring alerting logging security windows developer-tools windows edr threat-detection etw yara mitre-attack blueteam forensics kernel-telemetry

Member repositories

For agents

markdown · JSON · MCP: product_card(name="rabbitstack/fibratus")