Issues

• CI test harness for detection rules against Atomic Red Team

  cirulestype: enhancement
  rabbitstack/fibratus#715 · Filter by author rabbitstack opened on Jul 28, 2026

• Harden Fibratus against tampering

  scope: harderingtype: enhancement
  rabbitstack/fibratus#713 · Filter by author rabbitstack opened on Jul 25, 2026

• Add WMI activity telemetry

  needs: configscope: events/telemetrytype: feature
  rabbitstack/fibratus#710 · Filter by author rabbitstack opened on Jul 22, 2026

• Add Win32K input/hooking telemetry

  needs: configscope: events/telemetrytype: feature
  rabbitstack/fibratus#708 · Filter by author rabbitstack opened on Jul 21, 2026

• Capture NtFsControlFile syscall as a new FsControlFile event type

  needs: docsscope: events/telemetrytype: feature
  rabbitstack/fibratus#707 · Filter by author rabbitstack opened on Jul 21, 2026

• Add AMSI telemetry support via a new AmsiScanBuffer event type

  needs: configneeds: docsscope: events/telemetrytype: feature
  rabbitstack/fibratus#706 · Filter by author rabbitstack opened on Jul 21, 2026

• Track authentication events from the Windows Security Auditing provider

  needs: configneeds: docsscope: events/telemetrytype: feature
  rabbitstack/fibratus#705 · Filter by author rabbitstack opened on Jul 21, 2026

• Make the YARA scanner asynchronous to avoid blocking the event loop

  needs: configscope: yaratype: enhancement
  rabbitstack/fibratus#704 · Filter by author rabbitstack opened on Jul 19, 2026

• Publish Fibratus packages to Windows Package Manager (winget)

  scope: msi
  rabbitstack/fibratus#645 · Filter by author vitencells opened on Mar 6, 2026

• Publish Fibratus packages to Choco

  scope: msi
  rabbitstack/fibratus#644 · Filter by author vitencells opened on Mar 6, 2026

• Publish Fibratus packages to Scoop

  scope: msi
  rabbitstack/fibratus#643 · Filter by author vitencells opened on Mar 5, 2026

• Restrict access to config/log files

  scope: configscope: harderingtype: enhancement
  rabbitstack/fibratus#568 · Filter by author dobin opened on Jan 23, 2026
  2

• Replaying fails when converting big file into json format

  scope: capturetype: bug
  rabbitstack/fibratus#514 · Filter by author Swar2424 opened on Jun 3, 2025
  14

• Improve Transformers -> Allow them to interact with parameters that are not in "kparams"

  scope: transformerstype: feature
  rabbitstack/fibratus#506 · Filter by author cyohg opened on May 19, 2025
  19

• New logs CLI command

  needs: docsscope: cli
  rabbitstack/fibratus#410 · Filter by author rabbitstack opened on Dec 13, 2024

• Implement filament rule action

  needs: docsscope: filamentsscope: yara
  rabbitstack/fibratus#243 · Filter by author rabbitstack opened on Jan 24, 2024

• Allow running filaments with system Python interpreter

  needs: configneeds: docsscope: configscope: filaments
  rabbitstack/fibratus#242 · Filter by author rabbitstack opened on Jan 24, 2024
  2

• Obtain process token impersonation level

  good first issueneeds: docsneeds: filtersscope: filtersscope: pe
  rabbitstack/fibratus#208 · Filter by author rabbitstack opened on Nov 3, 2023
  1

• Obtain process token privileges

  good first issueneeds: docsneeds: filtersscope: filtersscope: process
  rabbitstack/fibratus#207 · Filter by author rabbitstack opened on Nov 3, 2023

• The installer set incorrectly the location of fibratus.yml

  good first issuescope: installertype: bug
  rabbitstack/fibratus#183 · Filter by author jrcribb opened on Jul 24, 2023
  1

• Implement ancestor_of and descendant_of process ancestry functions

  needs: docsneeds: filtersscope: filters
  rabbitstack/fibratus#68 · Filter by author rabbitstack opened on May 17, 2021

• Encrypt capture

  needs: configneeds: docsscope: capture
  rabbitstack/fibratus#52 · Filter by author rabbitstack opened on Mar 1, 2021

• Watch the ETW kernel logger session

  scope: events/telemetry
  rabbitstack/fibratus#48 · Filter by author rabbitstack opened on Feb 16, 2021

• CLI config edit command

  needs: docsscope: cli
  rabbitstack/fibratus#44 · Filter by author rabbitstack opened on Jan 12, 2021

• New encode transformer

  needs: configneeds: docsscope: transformers
  rabbitstack/fibratus#43 · Filter by author rabbitstack opened on Jan 11, 2021