Phantomwatch v1.0

🚀 PhantomWatch v1.0 – Initial Release

🔍 PhantomWatch is now live! This release marks the first official version (v1.0) of our advanced malware analysis and threat detection toolkit.

---

🔥 What's New in v1.0?

✅ Core Features:

• Static Analysis – Extract metadata, strings, and indicators of compromise (IOCs) from suspicious files.
• Dynamic Analysis – Submit malware samples to ANY.RUN for behavioral analysis.
• Threat Intelligence – Query Hybrid Analysis for additional insights on known malware hashes.
• YARA-Based Detection – Leverage VirusTotal YARA rules for signature-based detection.
• Sigma Rule Integration – Apply SigmaHQ rules for log-based threat detection.
• Database Storage – Save analysis results for future reference.
• Configurable API Support – Easily integrate with external security services.

---

📂 Folder Structure

PhantomWatch/
│── cli/ # Command-line interface
│── config/ # Configuration files
│── core/ # Core library
│── modules/ # Core analysis modules
│── rules/ # YARA & Sigma rules
│── output/ # Analysis results
│── test/ # Test Folder
│── venv/ # Virtual environment (recommended)
│── README.md # Documentation

📌 Installation and Usage

Installation

Prerequisites

Ensure your system has the following installed:

• Python 3
• pip (Python package manager)
• SQLite3

Steps

1. Clone the repository:

   git clone https://github.com/Phantom-Fort/phantomwatch.git
   cd phantomwatch

2. Run the installation script:

   chmod +x install.sh
   ./install.sh

3. Verify installation:

   phantomwatch

Usage

Initiate the interactive shell

phantomwatch

selecting a Module (phantomwatch>)

use <module-name>

sList available Modules (phantomwatch>)

list

Configuration

Modify config/config.json for custom settings. Sensitive credentials should be stored in config/secrets.env.

Example config.json:

{
    "log_level": "info",
    "database_path": "database/phantomwatch.db"
}

Example secrets.env:

API_KEY=your_api_key_here
SECRET_KEY=your_secret_key_here

🛠️ Known Issues & Fixes

⚠️ Missing Dependencies: Ensure libpcre.so.3 is installed for YARA support. Use:

sudo apt install libpcre3

⚠️ Configuration Errors: Verify API keys in config/config.py.

📢 What's Next? (v1.1 Roadmap)

🛡️ Enhanced Heuristic Analysis
🔗 MITRE ATT&CK Mapping
📊 Web Dashboard for Reports
🏴‍☠️ Ransomware Behavior Detection
💡 Contribute & Feedback
🚀 Found a bug or have an idea? Open an issue or contribute via PRs!

📩 Follow & Stay Updated:

Twitter
GitHub Discussions

👁️ PhantomWatch – Because Threats Never Sleep. 🕵️‍♂️💀