Adversary tradecraft detection, protection, and hunting
Get Started »
Docs
•
Rules
•
Filaments
•
Download
•
Discussions
Fibratus detects, protects, and eradicates advanced adversary tradecraft by scrutinizing and asserting a wide spectrum of system events against a behavior-driven rule engine and YARA memory scanner.
Events can also be shipped to a wide array of output sinks or dumped to capture files for local inspection and forensics analysis. You can use filaments to extend Fibratus with your own arsenal of tools and so leverage the power of the Python ecosystem.
In a nutshell, the Fibratus mantra is defined by the pillars of realtime behavior detection, memory scanning, and forensics capabilities.
- Install Fibratus from the latest MSI package
- spin up a command line prompt
- list credentials from the vault by using the
VaultCmdtool
$ VaultCmd.exe /listcreds:"Windows Credentials" /all
Credential discovery via VaultCmd.exerule should trigger displaying the alert in the systray notification area
To fully exploit and learn about Fibratus capabilities, read the docs.
Developed with ❤️ by Nedim Šabić Šabić
Logo designed with ❤️ by Karina Slizova