From c57bb698c58f3acc6501c80c18fd91f593c33269 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Sat, 8 Aug 2026 16:09:47 +0200 Subject: [PATCH] chore(docs): Prepare 3.1.0 docs and refine README --- CONTRIBUTING.md | 7 +++---- LICENSE.MD | 2 +- README.md | 32 ++++++++++++++++++++++--------- docs/rules.md | 15 +++++++++++++++ docs/rules/fields.md | 11 ++++------- docs/setup/installation.md | 13 ++++++++++++- docs/telemetry/callstacks.md | 2 +- docs/telemetry/events/registry.md | 8 ++++---- 8 files changed, 63 insertions(+), 27 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 12b2ebbed..9bacc8b1b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -5,8 +5,7 @@ We greatly appreciate you have considered contributing to Fibratus! Please, read ## Introduction 1. **You're familiar with [Github](https://github.com), git, and the pull request workflow** -2. **Make sure you've read Fibratus [docs](https://www.fibratus.io)** -3. If you got an idea about some feature that's not currently in the backlog, please create the [feature request](https://github.com/rabbitstack/fibratus/issues/new) first. The feature request should precisely describe the scope, requirements, and the motivation for the intended changeset +2. If you got an idea about some feature that's not currently in the backlog, please create the [feature request](https://github.com/rabbitstack/fibratus/issues/new) first. The feature request should precisely describe the scope, requirements, and the motivation for the intended changeset ## Your First Contribution @@ -99,7 +98,7 @@ To build Fibratus directly from source code you have to satisfy the following de By default, when building Fibratus, the Go compiler is instructed to ignore all features that trigger the [cgo](https://golang.org/cmd/cgo/), but you can control which features are enabled through the following build flags: - `filament`: compiles Fibratus with filaments support -- `kcap`: compiles Fibratus with support for capturing/replaying kcap files +- `cap`: compiles Fibratus with support for capturing/replaying cap files - `yara`: builds Fibratus with support for [Yara](https://virustotal.github.io/yara/) pattern matching To produce the Fibratus binary with the filaments support, you would run the following commands from the Powershell terminal: @@ -112,7 +111,7 @@ $ ./make To create the full-fledged Fibratus binary, activate all build flags: ``` -$ $env:TAGS="filament,kcap,yara" +$ $env:TAGS="filament,cap,yara" $ ./make ``` diff --git a/LICENSE.MD b/LICENSE.MD index b973d7766..7a1e002ab 100644 --- a/LICENSE.MD +++ b/LICENSE.MD @@ -1,4 +1,4 @@ -Copyright 2019-2024 by Nedim Sabic Sabic and contributors +Copyright 2019-2026 by Nedim Sabic Sabic and contributors https://www.fibratus.io All Rights Reserved. diff --git a/README.md b/README.md index 03a171afa..36565a60f 100644 --- a/README.md +++ b/README.md @@ -7,13 +7,13 @@

Fibratus

- Adversary tradecraft detection, protection, and hunting + Security sensor for realtime threat detection and protection
- Get Started » + Get Started »

- Docs + Docs   •   Rules   •   @@ -25,9 +25,9 @@

-Fibratus detects and eradicates advanced attacker tradecraft by scrutinizing and asserting a wide spectrum of [system events](https://fibratus.io/docs/telemetry/events) against a behavior-driven [rule engine](https://fibratus.io/docs/rules) and [YARA](https://fibratus.io/docs/yara) memory scanner. +Fibratus detects and eradicates advanced attacker tradecraft, malware, and emerging threats by scrutinizing and asserting a wide spectrum of [system events](https://docs.fibratus.io/telemetry/events) against a behavior-driven [rule engine](https://docs.fibratus.io/rules) and [YARA](https://docs.fibratus.io/yara) memory scanner. -Events can be routed to a wide range of [output sinks](https://fibratus.io/docs/telemetry/outputs) or written to [capture](https://fibratus.io/docs/captures) files for local inspection and forensic analysis. With [filaments](https://fibratus.io/docs/filaments), you can extend Fibratus with your own tooling and tap into the full power of the Python ecosystem. +Events can be routed to a wide range of [output sinks](https://docs.fibratus.io/telemetry/outputs) or written to [capture](https://docs.fibratus.io/captures) files for local inspection and forensic analysis. With [filaments](https://docs.fibratus.io/filaments), you can extend Fibratus with your own tooling and tap into the full power of the Python ecosystem. In a nutshell, the Fibratus mantra is built on three pillars: **realtime behavior detection**, **memory scanning**, and **forensics**. @@ -37,11 +37,25 @@ In a nutshell, the Fibratus mantra is built on three pillars: **realtime behavio

-### Installation and Quick start +### Get Fibratus Running -For installation and [quick start](https://www.fibratus.io/docs/setup/quick-start) instructions, go [here](https://www.fibratus.io/docs/setup/installation). +The fastest way to install Fibratus is to run the following command from an **elevated PowerShell** terminal: -### Contributing +``` +irm https://install.fibratus.io | iex +``` + +That's it. The installer downloads and sets up the latest version of Fibratus. + +Once installed, follow the [Quick Start](https://docs.fibratus.io/setup/quick-start) to see Fibratus detect your first security event in real time. + +> Prefer a manual installation? See the [Installation Guide](https://docs.fibratus.io/setup/installation) for alternative installation methods and detailed instructions. + +### Learn + +Go beyond the quick start and [learn](https://docs.fibratus.io) how Fibratus works under the hood. Explore the fundamentals, understand how Fibratus observes system activity, and learn how to build [rules](https://fibratus.io/rules) that detect and respond to threats. + +### Contribute We love contributions. To start contributing to Fibratus, please read our [contribution guidelines](https://github.com/rabbitstack/fibratus/blob/master/CONTRIBUTING.md). @@ -56,5 +70,5 @@ Free code signing provided by [SignPath.io], certificate by ---

- Developed with ❤️ by Nedim Šabić Šabić + Developed with ❤️ by Nedim Šabić Šabić and contributors

diff --git a/docs/rules.md b/docs/rules.md index 916bed483..04653bd88 100644 --- a/docs/rules.md +++ b/docs/rules.md @@ -2,6 +2,21 @@ ##### Fibratus rules define how behavioral patterns are detected from system telemetry. They allow expressing conditions over events and optionally trigger [response actions](rules/actions.md). Inspired by declarative detection formats like [Sigma](https://sigmahq.io/), Fibratus rules are designed to be readable, expressive, and tightly integrated with the event model. +## Built-in Rules and Sigma Compatibility + +Fibratus ships with a curated set of high-quality [rules](https://fibratus.io/rules) for detecting sophisticated and stealthy attack behaviors out of the box. These rules cover advanced patterns such as suspicious memory activity, code injection, memory-resident malware, privilege escalation and other techniques that may evade traditional file-based detection. + +Fibratus also supports converting [Sigma](https://sigmahq.io/) rules to Fibratus-compatible rules through the [RSigma](https://rsigma.io/) Fibratus [backend](https://rsigma.io/reference/backends/fibratus/). This allows existing Sigma rule collections to be adapted for use with Fibratus. + +To convert a directory of Sigma rules to Fibratus rules, use: + + +$ rsigma backend convert source-dir -t fibratus -p fibratus_windows -o target-dir + + + +Where `source-dir` contains the source Sigma rules and `target-dir` is the directory where the converted Fibratus rules are written. + ## Rule Structure A rule is defined in `YAML` format and consists of **metadata**, a detection **condition**, and optional response **actions**. diff --git a/docs/rules/fields.md b/docs/rules/fields.md index 35cbfa81f..4083ca18c 100644 --- a/docs/rules/fields.md +++ b/docs/rules/fields.md @@ -174,6 +174,7 @@ The following tables summarize available field names that can be employed in det | Field Name | Description | Example | | :--- | :---- | :--- | | `thread.callstack.summary` | Callstack summary showing involved modules | `thread.callstack.summary contains 'ntdll.dll\|KERNELBASE.dll'` | +| `thread.callstack.kernel_summary` | Kernel callstack summary showing involved kernel devices | `thread.callstack.kernel_summary contains '*\|srvnet.sys\|*'` | | `thread.callstack.detail` | Detailed information of each stack frame | `thread.callstack.detail contains 'KERNELBASE.dll!CreateProcessW'` | | `thread.callstack.modules` | List of modules comprising the callstack | `thread.callstack.modules in ('C:\WINDOWS\System32\KERNELBASE.dll')` | | `thread.callstack.symbols` | List of symbols comprising the callstack | `thread.callstack.symbols in ('ntdll.dll!NtCreateProcess')` | @@ -189,8 +190,8 @@ The following tables summarize available field names that can be employed in det | `thread.callstack.final_kernel_module.name` | The final kernel module name | `thread.callstack.final_kernel_module.name = 'FLTMGR.SYS'` | | `thread.callstack.final_kernel_module.path` | The final kernel module path | `thread.callstack.final_kernel_module.path imatches '?:\\WINDOWS\\System32\\drivers\\FLTMGR.SYS'` | | `thread.callstack.final_kernel_symbol.name` | The final kernel symbol name | `thread.callstack.final_kernel_symbol.name = 'FltGetStreamContext'` | -| `thread.callstack.final_user_module.signature.is_signed` | Indicates if the final user module is signed | `thread.callstack.final_user_module.signature.is_signed = true` | -| `thread.callstack.final_user_module.signature.is_trusted` | Indicates if the final user module signature is trusted | `thread.callstack.final_user_module.signature.is_trusted = true` | +| `thread.callstack.final_user_module.signature.exists` | Indicates if the final user module is signed | `thread.callstack.final_user_module.signature.exists = true` | +| `thread.callstack.final_user_module.signature.trusted` | Indicates if the final user module signature is trusted | `thread.callstack.final_user_module.signature.trusted = true` | | `thread.callstack.final_user_module.signature.cert.issuer` | The final user module signature certificate issuer | `thread.callstack.final_user_module.signature.cert.issuer imatches '*Microsoft Corporation*'` | | `thread.callstack.final_user_module.signature.cert.subject` | The final user module signature certificate subject | `thread.callstack.final_user_module.signature.cert.subject imatches '*Microsoft Windows*'` | @@ -214,8 +215,6 @@ The following tables summarize available field names that can be employed in det | `module.signature.issuer` | Module certificate CA | `module.signature.issuer contains 'US, Washington, Redmond, Microsoft Windows Production PCA 2011` | | `imodule.signature.after` | Module certificate expiration date | `module.signature.after contains '2024-02-01 00:05:42 +0000 UTC'` | | `module.signature.before` | Module certificate enrollment date | `module.signature.before contains '2024-02-01 00:05:42 +0000 UTC'` | -| `image.is_driver_malicious` | Indicates if the loaded driver is malicious | `module.is_driver_malicious` | -| `image.is_driver_vulnerable` | Indicates if the loaded driver is vulnerable | `module.is_driver_vulnerable` | | `module.is_dll` | Indicates if the loaded module is a DLL | `module.is_dll` | | `module.is_driver` | Indicates if the loaded module is a driver | `module.is_driver` | | `module.is_exec` | Indicates if the loaded module is an executable | `module.is_exec` | @@ -246,7 +245,7 @@ The following tables summarize available field names that can be employed in det | `file.path.stem` | File path without extension | `file.path.stem = 'C:\\Windows\\Sytem32\\regedit'` | | `file.name` | File name | `file.name = 'regedit.exe'` | | `file.operation` | Operation performed on the file or I/O device | `file.operation = 'OPEN'` | -| `file.share.mask` | File share mask | `file.share.mask = 'READ'` | +| `file.share_mode` | File share mode | `file.share_mode = 'READ'` | | `file.io.size` | I/O read/write size | `file.io.size > 512` | | `file.offset` | Read/write position in the file | `file.offset = 1024` | | `file.type` | File type. Possible values are `File`, `Directory`, `Pipe`, `Console`, `Mailslot`, `Other`, `Unknown` | `file.type = 'Directory'` | @@ -257,8 +256,6 @@ The following tables summarize available field names that can be employed in det | `file.view.size` | Size of the mapped/unmapped section view | `file.view.size > 1024` | | `file.view.type` | Type of the mapped/unmapped section view | `file.view.type = 'IMAGE'` | | `file.view.protection` | Protection rights of the section view | `file.view.protection = 'READONLY'` | -| `file.is_driver_malicious` | Indicates if the dropped driver is malicious | `file.is_driver_malicious` | -| `file.is_driver_vulnerable` | Indicates if the dropped driver is vulnerable | `file.is_driver_vulnerable` | | `file.is_dll` | Indicates if the created file is a DLL | `file.is_dll` | | `file.is_driver` | Indicates if the created file is a driver | `file.is_driver` | | `file.is_exec` | Indicates if the created file is an executable | `file.is_exec` | diff --git a/docs/setup/installation.md b/docs/setup/installation.md index d280688bc..2e34b3de1 100755 --- a/docs/setup/installation.md +++ b/docs/setup/installation.md @@ -19,8 +19,19 @@ Fibratus requires **administrator** or **SYSTEM** privileges to capture system e - executes [YARA](../yara.md) rules on freshly created process images or other image files when the [YARA scanner](../yara.md) is enabled - spins up an embedded Python interpreter to run [filaments](../filaments.md) +### One-liner Installation -### Installation +Install or upgrade Fibratus with a single PowerShell command. + + +$ irm https://install.fibratus.io | iex + + + + +The installer automatically downloads the latest [MSI](https://learn.microsoft.com/en-us/windows/win32/msi/installation-package) package, verifies its integrity using a checksum, and validates the package digital signature before proceeding. If either verification fails, the installation is aborted to prevent an untrusted or corrupted package from being installed. Once installation completes successfully, the Fibratus Windows service is started automatically which is immediately armed in protection mode to detect and neutralize threats. + +### Manual Installation diff --git a/docs/telemetry/callstacks.md b/docs/telemetry/callstacks.md index 32fc9ae14..cc37f7cbb 100644 --- a/docs/telemetry/callstacks.md +++ b/docs/telemetry/callstacks.md @@ -39,4 +39,4 @@ Stack enrichment is applied to the following event types: - `SubmitThreadpoolCallback` - `SetThreadpoolTimer` -Stack enrichment is enabled by default, but can be controlled via `--eventsource.stack-enrichment` configuration flag. To enable stack enrichment for kernel space return addresses, the `symbolize-kernel-addresses` config option needs to be set to `true` +Stack enrichment is enabled by default, but can be controlled via `--eventsource.stack-enrichment` configuration flag. To enable stack enrichment for kernel space symbols mapped to return addresses, the `symbolize-kernel-addresses` config option needs to be set to `true`. If not specified, only the kernel module paths are resolved in the callstacks. diff --git a/docs/telemetry/events/registry.md b/docs/telemetry/events/registry.md index 272d131fc..ba07c1deb 100644 --- a/docs/telemetry/events/registry.md +++ b/docs/telemetry/events/registry.md @@ -8,7 +8,7 @@ Creates a new registry key or opens the key if it already exists. Deletes a subk | PARAMETER | DESCRIPTION | | :--- | :---- | -| `key_handle` | Represents the address of the [KCB](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-regkcb) (Key Control Block) structure in kernel space. | +| `kcb` | Represents the address of the [KCB](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-regkcb) (Key Control Block) structure in kernel space. | | `key_path` | Full registry path involved in the operation, for example, `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control` | | `status` | System status code of the registry operation, for example, `More data is available` | @@ -18,7 +18,7 @@ Creates a new registry key or opens the key if it already exists. Deletes a subk | PARAMETER | DESCRIPTION | | :--- | :---- | -| `key_handle` | Represents the address of the [KCB](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-regkcb) (Key Control Block) structure in kernel space. | +| `kcb` | Represents the address of the [KCB](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-regkcb) (Key Control Block) structure in kernel space. | | `key_path` | Full path of the registry value, for example, `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel` | | `status` | System status code of the registry operation, for example, `The system cannot find the file specified` | @@ -29,7 +29,7 @@ Creates a new registry key or opens the key if it already exists. Deletes a subk | PARAMETER | DESCRIPTION | | :--- | :---- | -| `key_handle` | Represents the address of the [KCB](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-regkcb) (Key Control Block) structure in kernel space. | +| `kcb` | Represents the address of the [KCB](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-regkcb) (Key Control Block) structure in kernel space. | | `key_path` | Full path of the registry value, for example, `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel` | | `status` | System status code of the registry operation, for example, `Success` | | `data` | Value data being stored. | @@ -41,7 +41,7 @@ Creates a new registry key or opens the key if it already exists. Deletes a subk | PARAMETER | DESCRIPTION | | :--- | :---- | -| `key_handle` | Represents the address of the [KCB](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-regkcb) (Key Control Block) structure in kernel space. | +| `kcb` | Represents the address of the [KCB](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-regkcb) (Key Control Block) structure in kernel space. | | `key_path` | Full path of the registry value, for example, `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel` | | `status` | System status code of the registry operation, for example, `Success` | | `value_type` | Registry value type. Possible values include `REG_DWORD`, `REG_QWORD`, `REG_SZ`, `REG_EXPAND_SZ`, `REG_MULTI_SZ`, `REG_BINARY`, `UNKNOWN` | \ No newline at end of file