Skip to content

Commit 524ff4c

Browse files
rabbitstackrabbitstack
authored
docs: 2.2.0 docs (#298)
1 parent 8a42542 commit 524ff4c

25 files changed

+607
-643
lines changed

‎README.md‎

Lines changed: 15 additions & 135 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,16 @@
99
<h2 align="center">Fibratus</h2>
1010

1111
<p align="center">
12-
A modern tool for Windows kernel exploration and observability with a focus on security
12+
Adversary tradecraft detection, protection, and hunting
1313
<br>
1414
<a href="https://www.fibratus.io/#/setup/installation"><strong>Get Started »</strong></a>
1515
<br>
1616
<br>
1717
<strong>
1818
<a href="https://www.fibratus.io">Docs</a>
1919
&nbsp;&nbsp;&bull;&nbsp;&nbsp;
20+
<a href="https://github.com/rabbitstack/fibratus/tree/master/rules">Rules</a>
21+
&nbsp;&nbsp;&bull;&nbsp;&nbsp;
2022
<a href="https://github.com/rabbitstack/fibratus/tree/master/filaments">Filaments</a>
2123
&nbsp;&nbsp;&bull;&nbsp;&nbsp;
2224
<a href="https://github.com/rabbitstack/fibratus/releases">Download</a>
@@ -27,150 +29,28 @@
2729

2830
### What is Fibratus?
2931

30-
Fibratus is a tool for exploration and tracing of the **Windows** kernel. It lets you trap system-wide [events](https://www.fibratus.io/#/kevents/anatomy) such as process life-cycle, file system I/O, registry modifications or network requests among many other observability signals. In a nutshell, Fibratus allows for gaining deep operational visibility into the Windows kernel but also processes running on top of it. It requires no drivers nor third-party software.
32+
Fibratus detects, protects, and erradicates advanced adversary tradecraft by scrutinizing
33+
and asserting a wide spectrum of system events against a behaviour-driven [rule engine](https://www.fibratus.io/#/filters/rules) and [YARA](https://www.fibratus.io/#/yara/introduction) memory scanner.
3134

32-
Events can be shipped to a wide array of [output sinks](https://www.fibratus.io/#/outputs/introduction) or dumped to [capture](https://www.fibratus.io/#/captures/introduction) files for local inspection and forensics analysis. The powerful [filtering](https://www.fibratus.io/#/filters/introduction) engine permits drilling into the event flux entrails and the [rules engine](https://www.fibratus.io/#/filters/rules) is capable of detecting stealthy adversary attacks and sophisticated threats.
35+
Events can also be shipped to a wide array of [output sinks](https://www.fibratus.io/#/outputs/introduction) or dumped to [capture](https://www.fibratus.io/#/captures/introduction) files for local inspection and forensics analysis. You can use [filaments](https://www.fibratus.io/#/filaments/introduction) to extend Fibratus with your own arsenal of tools and so leverage the power of the Python ecosystem.
3336

34-
You can use [filaments](https://www.fibratus.io/#/filaments/introduction) to extend Fibratus with your own arsenal of tools and so leverage the power of the Python ecosystem
37+
In a nuthsell, Fibratus mantra is defined by the pillars of **realtime behaviour detection**, **memory scanning**, and **forensics** capabilities.
3538

3639
### Quick start
3740

38-
Check the [walkthrough](https://www.fibratus.io/#/filters/rules?id=loading-rules) on how to load and create detection rules.
39-
40-
- Observe Microsoft Outlook attachments creating on the file system
41-
42-
```
43-
fibratus run file.operation = 'create' and file.name icontains '\\Content.Outlook\\'
44-
```
45-
46-
- Hunt remote thread creations
47-
48-
```
49-
fibratus run kevt.name = 'CreateThread' and kevt.pid != thread.pid
50-
```
51-
52-
- Record network interactions to the capture file
53-
54-
```
55-
fibratus capture kevt.category = 'net' -o conns.kcap
56-
```
57-
58-
- Replay events from the capture
59-
60-
```
61-
fibratus replay net.dport in (443, 80) -k conns.kcap
62-
```
63-
64-
- Run the filament for watching file system changes
41+
---
6542

43+
- [Install](https://www.fibratus.io/#/setup/installation) Fibratus from the latest [MSI package](https://github.com/rabbitstack/fibratus/releases)
44+
- spin up a command line prompt
45+
- list credentials from the vault by using the `VaultCmd` tool
6646
```
67-
fibratus run -f watch_files
47+
$ VaultCmd.exe /listcreds:"Windows Credentials" /all
6848
```
49+
- `Credential discovery via VaultCmd.exe` rule should trigger displaying the alert in the systray notification area
6950

70-
### Features
71-
72-
- :zap: blazing fast
73-
- :satellite: collects a wide spectrum of kernel events - from process to network observability signals
74-
- :mag: super powerful filtering and rule engine
75-
- :snake: running Python scriptlets on top of kernel event flow
76-
- :minidisc: capturing event flux to **kcap** files and replaying anywhere
77-
- :rocket: transporting events to Elasticsearch, RabbitMQ or console sinks
78-
- :scissors: transforming kernel events
79-
- :dart: scanning malicious processes and files with Yara
80-
- :file_folder: PE (Portable Executable) introspection
81-
82-
### [Documentation](https://www.fibratus.io)
83-
---
84-
85-
### Setup
86-
87-
* [**Installation**](https://www.fibratus.io/#/setup/installation)
88-
* [**Building from source**](https://www.fibratus.io/#/setup/installation?id=building-from-source)
89-
* [**Running as standalone binary**](https://www.fibratus.io/#/setup/running?id=standalone-binary)
90-
* [**Running as Windows Service**](https://www.fibratus.io/#/setup/running?id=windows-service)
91-
* [**CLI**](https://www.fibratus.io/#/setup/running?id=cli)
92-
* [**Configuration**](https://www.fibratus.io/#/setup/configuration)
93-
94-
### Events
95-
96-
* [**Anatomy of an event**](https://www.fibratus.io/#/kevents/anatomy)
97-
* [**Process**](https://www.fibratus.io/#/kevents/process)
98-
* [**Thread**](https://www.fibratus.io/#/kevents/thread)
99-
* [**Image**](https://www.fibratus.io/#/kevents/image)
100-
* [**File**](https://www.fibratus.io/#/kevents/file)
101-
* [**Registry**](https://www.fibratus.io/#/kevents/registry)
102-
* [**Network**](https://www.fibratus.io/#/kevents/network)
103-
* [**Handle**](https://www.fibratus.io/#/kevents/handle)
104-
105-
### Filters and Rules
106-
107-
* [**Needle in the haystack**](https://www.fibratus.io/#/filters/introduction)
108-
* [**Prefiltering**](https://www.fibratus.io/#/filters/prefiltering)
109-
* [**Filtering**](https://www.fibratus.io/#/filters/filtering)
110-
* [**Operators**](https://www.fibratus.io/#/filters/operators)
111-
* [**Functions**](https://www.fibratus.io/#/filters/functions)
112-
* [**Paths**](https://www.fibratus.io/#/filters/paths)
113-
* [**Fields**](https://www.fibratus.io/#/filters/fields)
114-
* [**Rules**](https://www.fibratus.io/#/filters/rules)
115-
116-
### Captures
117-
118-
* [**Immortalizing the event flux**](https://www.fibratus.io/#/captures/introduction)
119-
* [**Capturing**](https://www.fibratus.io/#/captures/capturing)
120-
* [**Replaying**](https://www.fibratus.io/#/captures/replaying)
121-
122-
### Filaments
123-
124-
* [**Python meets kernel events**](https://www.fibratus.io/#/filaments/introduction)
125-
* [**Executing**](https://www.fibratus.io/#/filaments/executing)
126-
* [**Internals**](https://www.fibratus.io/#/filaments/internals)
127-
* [**Writing filaments**](https://www.fibratus.io/#/filaments/writing)
128-
129-
### Outputs
130-
131-
* [**Transporting kernel events**](https://www.fibratus.io/#/outputs/introduction)
132-
* [**Console**](https://www.fibratus.io/#/outputs/console)
133-
* [**Null**](https://www.fibratus.io/#/outputs/null)
134-
* [**RabbitMQ**](https://www.fibratus.io/#/outputs/rabbitmq)
135-
* [**Elasticsearch**](https://www.fibratus.io/#/outputs/elasticsearch)
136-
* [**Eventlog**](https://www.fibratus.io/#/outputs/eventlog)
137-
* [**HTTP**](https://www.fibratus.io/#/outputs/http)
138-
139-
140-
### Transformers
141-
142-
* [**Parsing, enriching, transforming**](https://www.fibratus.io/#/transformers/introduction)
143-
* [**Remove**](https://www.fibratus.io/#/transformers/remove)
144-
* [**Rename**](https://www.fibratus.io/#/transformers/rename)
145-
* [**Replace**](https://www.fibratus.io/#/transformers/replace)
146-
* [**Tags**](https://www.fibratus.io/#/transformers/tags)
147-
* [**Trim**](https://www.fibratus.io/#/transformers/trim)
148-
149-
### Alerts
150-
151-
* [**Watchdogging kernel events**](https://www.fibratus.io/#/alerts/introduction)
152-
* [**Mail**](https://www.fibratus.io/#/alerts/senders/mail)
153-
* [**Slack**](https://www.fibratus.io/#/alerts/senders/slack)
154-
* [**Filament alerting**](https://www.fibratus.io/#/alerts/filaments)
155-
156-
### PE (Portable Executable)
157-
158-
* [**Portable Executable introspection**](https://www.fibratus.io/#/pe/introduction)
159-
* [**Sections**](https://www.fibratus.io/#/pe/sections)
160-
* [**Symbols**](https://www.fibratus.io/#/pe/symbols)
161-
* [**Resources**](https://www.fibratus.io/#/pe/resources)
162-
163-
### YARA
164-
165-
* [**Pattern matching swiss knife**](https://www.fibratus.io/#/yara/introduction)
166-
* [**Scanning processes**](https://www.fibratus.io/#/yara/scanning)
167-
* [**Alerts**](https://www.fibratus.io/#/yara/alerts)
168-
169-
### Troubleshooting
51+
### Documentation
17052

171-
* [**Logs**](https://www.fibratus.io/#/troubleshooting/logs)
172-
* [**Stats**](https://www.fibratus.io/#/troubleshooting/stats)
173-
* [**Profiling**](https://www.fibratus.io/#/troubleshooting/pprof)
53+
To fully exploit and learn about Fibratus capabilities, read the [docs](https://www.fibratus.io).
17454

17555
---
17656

‎docs/_coverpage.md‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,13 @@
44
<img src='logo.png'></img>
55
</div>
66

7-
# fibratus <small>2.0.0</small>
7+
# fibratus <small>2.2.0</small>
88

9-
> A modern tool for Windows kernel exploration and observability with a focus on security
10-
11-
- <ion-icon class="fast-icon" name="flash"></ion-icon> Fast
12-
- <ion-icon class="extensible-icon" name="cube"></ion-icon> Extensible
13-
- <ion-icon class="comprehensive-icon" name="magnet"></ion-icon> Comprehensive
9+
> Adversary tradecraft detection, protection, and hunting
1410
11+
- <ion-icon class="fast-icon" name="flash"></ion-icon> Runtime behaviour detection
12+
- <ion-icon class="comprehensive-icon" name="magnet"></ion-icon> Forensics capabilities
13+
- <ion-icon class="extensible-icon" name="cube"></ion-icon> Memory scanning
1514

1615
<a href="https://github.com/rabbitstack/fibratus/releases" target="_blank" rel="noopener"><ion-icon name="download"></ion-icon> Download</a>
1716
<a href="#/setup/installation"><ion-icon name="rocket"></ion-icon> Get Started</a>

‎docs/_sidebar.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,9 @@
22
* [What is Fibratus?](overview/what-is-fibratus.md)
33
* <ion-icon name="rocket-outline"></ion-icon> Setup
44
* [Installation](setup/installation.md)
5-
* [Running](setup/running.md)
5+
* [Quick Start](setup/quick-start.md)
66
* [Configuration](setup/configuration.md)
7+
* [CLI](setup/cli.md)
78
* <ion-icon name="apps-outline"></ion-icon> Events
89
* [Anatomy Of An Event](kevents/anatomy.md)
910
* [Process](kevents/process.md)
@@ -22,8 +23,8 @@
2223
* [Operators](filters/operators.md)
2324
* [Paths](filters/paths.md)
2425
* [Functions](filters/functions.md)
25-
* [Fields](filters/fields.md)
2626
* [Rules](filters/rules.md)
27+
* [Fields](filters/fields.md)
2728
* <ion-icon name="server-outline"></ion-icon> Captures
2829
* [Immortalizing The Event Flux](captures/introduction.md)
2930
* [Capturing](captures/capturing.md)
@@ -34,7 +35,7 @@
3435
* [Internals](filaments/internals.md)
3536
* [Writing Filaments](filaments/writing.md)
3637
* <ion-icon name="send-outline"></ion-icon> Outputs
37-
* [Transporting Kernel Events](outputs/introduction.md)
38+
* [Transporting Events](outputs/introduction.md)
3839
* [Console](outputs/console.md)
3940
* [Null](outputs/null.md)
4041
* [RabbitMQ](outputs/rabbitmq.md)
@@ -49,7 +50,7 @@
4950
* <ion-icon name="pricetags-outline"></ion-icon> [Tags](transformers/tags.md)
5051
* <ion-icon name="cut-outline"></ion-icon> [Trim](transformers/trim.md)
5152
* <ion-icon name="locate-outline"></ion-icon> Alerts
52-
* [Watchdogging Kernel Events](alerts/introduction.md)
53+
* [Firing Alerts](alerts/introduction.md)
5354
* [Alert Senders](alerts/senders.md)
5455
* <ion-icon name="mail-unread-outline"></ion-icon> [Mail](alerts/senders/mail.md)
5556
* <ion-icon name="logo-slack"></ion-icon> [Slack](alerts/senders/slack.md)

‎docs/alerts/introduction.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
# Watchdogging Kernel Events
1+
# Firing Alerts
22

3-
Fibratus has the ability to generate alerts when an unexpected flow is detected in the system. Some alerts are generated out of the box, for example, when the [YARA scanner](/yara/scanning) yields rule matches. Other alerts are emitted directly from [filaments](/alerts/filaments) when the conditions are met.
3+
Fibratus has the ability to generate security alerts when the detection or [YARA](/yara/scanning) rule matches. Additionally, alerts can be emitted directly from [filaments](/alerts/filaments).
44

55
The alert has the following key components:
66

‎docs/alerts/senders.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@ You can send alert notifications to your team through email, Slack, or incident
44

55
- [Mail](/alerts/senders/mail)
66
- [Slack](/alerts/senders/mail)
7+
- [Systray](/alerts/senders/systray)
8+

‎docs/alerts/senders/systray.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Systray
2+
3+
The `systray` alert sender sends alerts to the systray notification area.
4+
5+
### Configuration {docsify-ignore}
6+
7+
The `systray` alert sender configuration is located in the `alertsenders.systray` section.
8+
9+
#### enabled
10+
11+
Indicates whether the `systray` alert sender is enabled.
12+
13+
**default**: `true`
14+
15+
#### sound
16+
17+
Indicates if the associated sound is played when the balloon notification is shown.
18+
19+
**default**: `true`
20+
21+
#### quiet-mode
22+
23+
Instructs not to display the balloon notification if the current user is in quiet time. During this time, most notifications should not be sent or shown. This lets a user become accustomed to a new computer system without those distractions. Quiet time also occurs for each user after an operating system upgrade or clean installation.
24+
25+
**default**: `false`
26+

‎docs/filters/fields.md‎

Lines changed: 34 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ The following tables summarize available field names that can be used in filter
1515
| Field Name | Description | Example |
1616
| :--- | :---- | :---: |
1717
| kevt.seq | Monotonic event sequence number | `kevt.seq > 666` |
18-
| kevt.pid | Process identifier generating the kernel event | `kevt.pid = 6` |
19-
| kevt.tid | Thread identifier generating the kernel event | `kevt.tid = 1024` |
18+
| kevt.pid | Process identifier generating the event | `kevt.pid = 6` |
19+
| kevt.tid | Thread identifier generating the event | `kevt.tid = 1024` |
2020
| kevt.cpu | Logical processor core where the event was generated | `kevt.cpu = 2` |
2121
| kevt.name | Symbolical event name | `kevt.name = 'CreateThread'` |
2222
| kevt.category | Category to which the event pertains | `kevt.category = 'registry'` |
@@ -41,8 +41,8 @@ The following tables summarize available field names that can be used in filter
4141
### Process
4242
| Field Name | Description | Example |
4343
| :--- | :---- | :---: |
44-
| ps.pid | Process identifier generating the kernel event. Alias for `kevt.pid` | `ps.pid = 1024` |
45-
| ps.ppid | Parent process identifier of the process generating the kernel event | `ps.ppid = 25` |
44+
| ps.pid | Process identifier generating the event. Alias for `kevt.pid` | `ps.pid = 1024` |
45+
| ps.ppid | Parent process identifier of the process generating the event | `ps.ppid = 25` |
4646
| ps.name | Process (image) path name that generates an event | `ps.name = 'cmd.exe'` |
4747
| ps.cmdline | Process command line | `ps.cmdline contains '/E c:\\ads\\file.txt:regfile.reg'` |
4848
| ps.exe | Full name of the process' executable | `ps.exe = 'C:\\Windows\\system32\\cmd.exe'` |
@@ -106,6 +106,20 @@ The following tables summarize available field names that can be used in filter
106106
| thread.access.status | Thread access status | `thread.access.status = 'Success'` |
107107

108108

109+
### Callstack
110+
| Field Name | Description | Example |
111+
| :--- | :---- | :---: |
112+
| thread.callstack.summary | Callstack summary showing involved modules | `thread.callstack.summary contains 'ntdll.dll\|KERNELBASE.dll'` |
113+
| thread.callstack.detail | Detailed information of each stack frame | `thread.callstack.detail contains 'KERNELBASE.dll!CreateProcessW'` |
114+
| thread.callstack.modules | List of modules comprising the callstack | `thread.callstack.modules in ('C:\WINDOWS\System32\KERNELBASE.dll')` |
115+
| thread.callstack.symbols | List of symbols comprising the callstack | `thread.callstack.symbols in ('ntdll.dll!NtCreateProcess')` |
116+
| thread.callstack.allocation_sizes | Allocation sizes of private pages | `thread.callstack.allocation_sizes > 10000` |
117+
| thread.callstack.protections | Page protections masks of each frame | `thread.callstack.protections in ('RWX', 'WX')'` |
118+
| thread.callstack.callsite_leading_assembly | Callsite leading assembly instructions | `thread.callstack.callsite_leading_assembly in ('mov r10,rcx', 'syscall')` |
119+
| thread.callstack.callsite_trailing_assembly | Callsite trailing assembly instructions | `thread.callstack.callsite_trailing_assembly in ('add esp, 0xab')` |
120+
| thread.callstack.is_unbacked | Indicates if the callstack contains unbacked regions | `thread.callstack.is_unbacked` |
121+
122+
109123
### Image
110124
| Field Name | Description | Example |
111125
| :--- | :---- | :---: |
@@ -121,7 +135,11 @@ The following tables summarize available field names that can be used in filter
121135
| image.cert.issuer | Image certificate CA | `image.cert.issuer contains 'US, Washington, Redmond, Microsoft Windows Production PCA 2011` |
122136
| image.cert.after | Image certificate expiration date | `image.cert.after contains '2024-02-01 00:05:42 +0000 UTC'` |
123137
| image.cert.before | Image certificate enrollment date | `image.cert.before contains '2024-02-01 00:05:42 +0000 UTC'` |
124-
138+
| image.is_driver_malicious | Indicates if the loaded driver is malicious | `image.is_driver_malicious` |
139+
| image.is_driver_vulnerable | Indicates if the loaded driver is vulnerable | `image.is_driver_vulnerable` |
140+
| image.is_dll | Indicates if the loaded image is a DLL | `image.is_dll` |
141+
| image.is_driver | Indicates if the loaded image is a driver | `image.is_driver` |
142+
| image.is_exec | Indicates if the loaded image is an executable | `image.is_exec` |
125143

126144
### File
127145
| Field Name | Description | Example |
@@ -139,6 +157,12 @@ The following tables summarize available field names that can be used in filter
139157
| file.view.base | Base address of the mapped/unmapped section view | `file.view.base = '25d42170000'` |
140158
| file.view.size | Size of the mapped/unmapped section view | `file.view.size > 1024` |
141159
| file.view.type | Type of the mapped/unmapped section view | `file.view.type = 'IMAGE'` |
160+
| file.view.protection | Protection rights of the section view | `file.view.protection = 'READONLY'` |
161+
| file.is_driver_malicious | Indicates if the dropped driver is malicious | `file.is_driver_malicious` |
162+
| file.is_driver_vulnerable | Indicates if the dropped driver is vulnerable | `file.is_driver_vulnerable` |
163+
| file.is_dll | Indicates if the created file is a DLL | `file.is_dll` |
164+
| file.is_driver | Indicates if the created file is a driver | `file.is_driver` |
165+
| file.is_exec | Indicates if the crated file is an executable | `file.is_exec` |
142166

143167

144168
### Registry
@@ -164,6 +188,7 @@ The following tables summarize available field names that can be used in filter
164188
| net.dip.names | List of destination IP address domain names | `net.dip.names in ('github.com.')` |
165189
| net.sip.names | List of source IP address domain names | `net.sip.names in ('github.com.')` |
166190

191+
167192
### Handle
168193
| Field Name | Description | Example |
169194
| :--- | :---- | :---: |
@@ -172,6 +197,7 @@ The following tables summarize available field names that can be used in filter
172197
| handle.name | Handle name | `handle.name = '\\Device\\NamedPipe\\chrome.12644.28.105826381'` |
173198
| handle.type | Handle type | `handle.type = 'Mutant'` |
174199

200+
175201
### Memory
176202
| Field Name | Description | Example |
177203
| :--- | :---- | :---: |
@@ -226,3 +252,6 @@ The following tables summarize available field names that can be used in filter
226252
| pe.cert.issuer | PE certificate CA | `pe.cert.issuer contains 'US, Washington, Redmond, Microsoft Windows Production PCA 2011'` |
227253
| pe.cert.after | PE certificate expiration date | `pe.cert.after contains '2024-02-01 00:05:42 +0000 UTC'` |
228254
| pe.cert.before | PE certificate enrollment date | `pe.cert.before contains '2024-02-01 00:05:42 +0000 UTC'` |
255+
| pe.is_modified | Indicates if on-disk and in-memory PE headers differ | `pe.is_modified'` |
256+
| pe.is_modified | Indicates if on-disk and in-memory PE headers differ | `pe.is_modified'` |
257+
| pe.ps.child.file.name | Original file name of the child process executable supplied at compile-time | `pe.ps.child.file.name = 'NOTEPAD.EXE'` |

0 commit comments

Comments
 (0)