Fibratus relies on Windows ETW API to collect the raw information emitted from the operating system’s kernel. The kernel stream collector (kstreamc) deals with the basic decoding of the ETW data by installing the callback interface on the kernel event stream. Each of the kernel events is routed from the collector to a chain of parsers. Before hitting the parsers, the event queries the thread registry to get the process associated with the occurrence of the kernel event.

Changelog v1.2

New features

  • filament for identifying an executable or script file remotely downloaded via a TeamViewer transfer session
  • reverse DNS lookups
  • function support in filters and initial cidr_contains and md5 functions
  • dip.names and sip.names filter fields
  • unary not operator in filters
  • matches and imatches string matching operators
  • make the use of fields possible in both LHS/RHS filter expressions
  • CI pipeline for automated builds/releases
  • code linting via golangci
  • full and slim MSI-based Windows installers


  • introduce a new file.extension filter field
  • documentation website tweaking
  • make all string operators evaluable against lists
  • tests refactoring
  • satisfy all code linters
  • upgrade to the latest go-yara package
  • improvements in the handle interceptor when publishing deferred CreateHandle events
  • reduce the pressure on the TdhGetPropertySize API call for static parameter types
  • prettify fibratus version output
  • modularize and improve signal handling

Bug fixes

  • circumvent data races in kcap reader/writer
  • prevent data races in the AMQP connection
  • yara scanner should allocate a new scanner for each run
  • fix RecvUDPv4 event type GUID
  • the handle interceptor should return the CloseHandle event when entering the deferred map