Endpoint protection
built in the open.
ShadowStrike Phantom is an open-source endpoint protection platform for Windows. Kernel-level detection, behavioral analysis, syscall tracing, and full threat intelligence — every line of code auditable, no black boxes.
Everything an endpoint protection platform demands.
PhantomSensor operates at every layer of the Windows security model — from kernel callbacks to user-space behavioral analysis. No telemetry blind spots.
Kernel-Level Monitoring
Minifilter driver hooks file system I/O at altitude 328000. Full read/write/create/delete interception, pre- and post-operation callbacks.
Behavioral Analysis
Attack chain tracker correlates kernel events across process trees. MITRE ATT&CK mapping with real-time threat scoring.
Memory Inspection
VAD tree traversal, shellcode pattern detection, process hollowing and injection recognition, heap spray analysis, ROP chain tracing.
Syscall Tracing
Direct syscall detection, Heaven's Gate (WoW64) transition monitoring, NTDLL integrity verification, and call stack origin analysis.
Network Detection
C2 communication patterns, DNS anomaly detection, data exfiltration monitoring, SSL inspection, and protocol-level analysis.
Threat Intelligence
IOC database with bloom filter for O(1) lookups. STIX/TAXII feed support, URL reputation engine, and LRU-cached reputation queries.
Anti-Evasion Engine
Sandbox detection, debugger evasion analysis, VM fingerprinting, packer identification, and metamorphic/polymorphic code analysis.
Self-Protection
ObRegisterCallbacks for handle blocking, anti-unload mechanisms, callback protection, and driver integrity monitoring.
Ransomware Detection
Honeypot file monitoring, shadow copy protection, backup integrity, entropy analysis for mass encryption detection.
Four layers, zero blind spots.
PhantomSensor spans from UEFI firmware through the Windows kernel into user-space services. Each layer feeds telemetry upward, decisions propagate downward.
MITRE ATT&CK
Known techniques, mapped & tracked. Phantom's kernel driver has T-ID constants for all 403 MITRE ATT&CK techniques across 14 tactics.
Detection grid by tactic.
Highlighted techniques have an active BehaviorEngine rule. The rest have the T-ID defined and ready to be wired up.
Kernel access should be earned through trust.
Every endpoint protection platform runs with the highest privilege on your system. We believe that privilege demands transparency — so we publish everything.
Fully Transparent
Every kernel callback, every detection rule, every heuristic — all source code is publicly auditable on GitHub. No hidden agents, no undisclosed telemetry.
No Black Boxes
Commercial endpoint products run kernel-level code you cannot inspect. Phantom is the alternative: full visibility into what runs with ring-0 access on your machine.
Educational by Design
The codebase is structured to be read. Detailed comments, architectural documentation, and research posts explain how real detection works at each layer.
Community-Driven
Built in public from day one. Security researchers, kernel developers, and detection engineers collaborate openly — no gatekeeping, no NDAs.
Follow the development journey
5 commits daily. Every module built in public. Watch the kernel driver come to life.