FIBRATUS

Summary from the TLDR InfoSec newsletter

Fibratus detects, protects, and eradicates advanced adversary tradecraft by scrutinizing and asserting a wide spectrum of system events against a behavior-driven rule engine and YARA memory scanner. Events can be shipped to a wide array of output sinks or dumped to capture files for local inspection and forensics analysis. Users can use filaments to extend Fibratus with their own arsenal of tools and so leverage the power of the Python ecosystem.