Release Notes
Explore the full changelog here.
New features
Kernel callstack enrichment and stabilization
Enrichment of kernel callstack information by resolving kernel addresses to their corresponding driver modules and enriching events with a kernel thread callstack summary. Callstack return addresses are now stitched to events using timestamps, providing more reliable context for kernel activity and improving the accuracy of callstack-based filtering and detection.
Improved digital signature verification pipeline
The digital signature verification pipeline has been overhauled to make signature verification more reliable and efficient. Fibratus now uses an improved asynchronous verification pipeline with better cache keying, eager metadata-store initialization, and more robust handling of freshly added signatures.
Event processing volume reduction with dynamic filtering
Smart event filtering with approvers allows events to be dynamically evaluated and discarded before they propagate through the entire processing pipeline. This substantially reduces the volume of events that need to be processed while preserving events relevant to detection and investigation.
The filtering and approver pipeline has also received several performance improvements, including pattern precompilation, path string interning, object pooling, cached filter values, and more efficient wildcard matching.
11 new detection rules
Added 11 new detection rules, expanding coverage for a range of lateral movement, defense evasion, credential access, and suspicious DLL-loading techniques.
Breaking changes
- removal of malicious/vulnerable driver filter fields. Detection rules were removed as well.