fibratus
fibratus copied to clipboard
Implement `scan_proc` and `scan_file` filament functions
These functions would cooperate with the Yara scanner to trigger rule execution within the filament. The functions should return which rules and strings were matched along with other useful information.
This functionality would be especially beneficial for enriching certain analyses. For example, it would be possible to scan the process only after a particular condition is met in the filament code.