ShadowStrike Phantom

Open-Source Next-Generation Endpoint Protection Platform for Windows

Custom kernel sensor · Full-system emulation engine

Website · Architecture · Roadmap · Join Beta · Research

Driver loaded with ETW tracing active

Driver Verifier — all checks passed

If you believe in open-source security, consider supporting development:

Your support helps build transparent, auditable endpoint protection that anyone can verify.

ShadowStrike Phantom is a from-scratch, open-source endpoint protection platform for Windows 10/11 x64, engineered to compete with the detection capabilities of commercial EDR/XDR products — CrowdStrike Falcon, SentinelOne Singularity, Microsoft Defender for Endpoint — with one fundamental difference: every line of code is auditable.

This is not a wrapper around existing tools, and not a proof of concept. It is a security platform built to production engineering standards, comprising five major subsystems each written from the ground up, currently at alpha maturity and being hardened against live Windows endpoints.

Current state — alpha, under active development, tested against live Windows endpoints. The kernel driver is complete: Coverity-verified at 0.25 defects/KLoC, passing Driver Verifier with zero violations, loading and filtering on a live endpoint. The user-mode engine is feature-complete and in a security-hardening phase — the product installs, loads its signed driver, establishes an encrypted kernel channel and performs on-access scanning, with a recent field run scanning 56,866 files on a live endpoint. The emulation engine is implemented. The AI models are trained on 3.5M+ real PE samples (EMBER 2018 + EMBER 2024) and the inference path is wired into the scan pipeline, but the models are not yet packaged for endpoint deployment. Public beta is targeted for the start of 2027. See Known Limitations for a full account of what is not finished.

Commercial endpoint protection products run kernel-level code you cannot inspect. Every major vendor — including those who have caused global outages from faulty kernel updates — ships a black box with ring-0 access to your machine.

ShadowStrike Phantom is the alternative:

• No hidden telemetry. Every network call the product makes is in the source.
• No black-box detection. Every rule, every heuristic, every model weight is auditable.
• No trust required. Read the code. Build it. Verify it. Run it on your own infrastructure.

┌──────────────────────────────────────────────────────────────────────────────────────────┐
│                                      USER MODE                                            │
├──────────────────────────────────────────────────────────────────────────────────────────┤
│                                                                                           │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐                  │
│  │  PhantomEDR  │  │ PhantomHome  │  │ PhantomXDR   │  │  Dashboard   │                  │
│  │  (Service)   │  │    (GUI)     │  │  (Service)   │  │  (Planned)   │                  │
│  └──────┬───────┘  └──────┬───────┘  └──────┬───────┘  └──────────────┘                  │
│         └──────────────────┴──────────────────┘                                           │
│                            │                                                              │
│  ┌─────────────────────────┴──────────────────────────┐                                  │
│  │           Shared Detection Infrastructure           │                                  │
│  │  ┌────────────────────────────────────────────────┐ │                                  │
│  │  │ RealTimeProtection · ExploitPrevention         │ │                                  │
│  │  │ BehaviorBlocker · ProcessCreationMonitor       │ │                                  │
│  │  │ NetworkTrafficFilter · MemoryProtection        │ │                                  │
│  │  │ FileSystemFilter · ZeroHourProtection          │ │                                  │
│  │  └────────────────────────────────────────────────┘ │                                  │
│  │  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌────────┐ │                                  │
│  │  │Signature │ │ Pattern  │ │  Hash    │ │ Threat │ │                                  │
│  │  │  Store   │ │  Store   │ │  Store   │ │ Intel  │ │                                  │
│  │  │ (B-tree) │ │(Aho-Cor.)│ │ (Bloom)  │ │(STIX)  │ │                                  │
│  │  └──────────┘ └──────────┘ └──────────┘ └────────┘ │                                  │
│  │  ┌──────────────────┐  ┌──────────────────────────┐ │                                  │
│  │  │ PhantomEmulator  │  │     PhantomCortex AI     │ │                                  │
│  │  │ x86/x64 CPU Emu  │  │  5 Neural Network Models │ │                                  │
│  │  │ 10 DLL Emulation │  │  ONNX Runtime            │ │                                  │
│  │  └──────────────────┘  └──────────────────────────┘ │                                  │
│  └─────────────────────────┬──────────────────────────┘                                  │
│                            │                                                              │
│              ┌─────────────┴─────────────┐                                               │
│              │   Encrypted IPC Bridge    │                                                │
│              │  (FilterConnectPort)      │                                                │
│              └─────────────┬─────────────┘                                               │
├────────────────────────────┼─────────────────────────────────────────────────────────────┤
│                        KERNEL MODE                                                        │
├────────────────────────────┼─────────────────────────────────────────────────────────────┤
│              ┌─────────────┴─────────────┐                                               │
│              │    PhantomSensor.sys       │                                               │
│              │  WDM Minifilter · Alt 385210                                              │
│              │     · 20 Subsystems        │                                               │
│              └─────────────┬─────────────┘                                               │
│   ┌────────────────────────┼────────────────────────┐                                    │
│   ▼                        ▼                        ▼                                    │
│ ┌──────────────┐ ┌─────────────────────┐ ┌──────────────────┐                            │
│ │ File System  │ │  Process / Thread   │ │ Registry Monitor │                            │
│ │  Callbacks   │ │  Image · Syscall    │ │ Persistence Det. │                            │
│ └──────────────┘ └─────────────────────┘ └──────────────────┘                            │
│ ┌──────────────┐ ┌─────────────────────┐ ┌──────────────────┐                            │
│ │ Memory Mon   │ │  Object Callbacks   │ │ Self-Protection  │                            │
│ │ VAD·ROP·Inj  │ │  Handle Protection  │ │ Anti-Tamper      │                            │
│ └──────────────┘ └─────────────────────┘ └──────────────────┘                            │
│ ┌──────────────┐ ┌─────────────────────┐ ┌──────────────────┐                            │
│ │ Network Flt  │ │  Behavioral Engine  │ │ ETW Telemetry    │                            │
│ │ C2·DGA·Exfil │ │  MITRE · Scoring    │ │ Structured Trace │                            │
│ └──────────────┘ └─────────────────────┘ └──────────────────┘                            │
├──────────────────────────────────────────────────────────────────────────────────────────┤
│                              HARDWARE / FIRMWARE                                          │
│                Secure Boot · TPM Attestation · Firmware Integrity                         │
└──────────────────────────────────────────────────────────────────────────────────────────┘

A from-scratch WDM minifilter kernel driver that intercepts, analyzes, and blocks threats at the lowest software level. Coverity static analysis reports 0.25 defects/KLoC; Driver Verifier reports zero violations.

• Windows Filter Manager minifilter — altitude 385210, 14 operation callbacks
• PsSetCreateProcessNotifyRoutineEx2 — process lifecycle with LOLBin scoring
• CmRegisterCallbackEx — registry monitoring with persistence detection
• ObRegisterCallbacks — handle-based self-protection with suspicion scoring
• /INTEGRITYCHECK linked for PsSetCreateProcessNotifyRoutineEx compliance
• CNG (BCrypt) — kernel-mode SHA-256/MD5 hashing for file reputation
• Memory-mapped shared definitions for kernel↔user-mode type safety

A custom-built x86/x64 CPU emulation engine for safe malware detonation and analysis — no hypervisor dependency, no third-party emulation library. Designed to execute and analyze packed, obfuscated, and evasion-aware malware in a fully controlled virtual environment.

• Virtual File System — Isolated FS with pre-seeded Windows directory structure
• Virtual Registry — Full HKLM/HKCU emulation with common key population
• Virtual Network — Simulated DNS, HTTP, and socket responses for C2 detonation
• Virtual Process — Process environment block (PEB/TEB) emulation

• Timing anti-evasion — Accelerated tick counts, QueryPerformanceCounter spoofing, GetTickCount manipulation
• Debugger anti-evasion — IsDebuggerPresent returns false, PEB flags cleaned, NtQueryInformationProcess spoofed
• Environment anti-evasion — Realistic CPU/RAM/disk metrics, proper username/computername, registry artifacts
• VM anti-evasion — No hypervisor artifacts, realistic CPUID responses, clean SMBIOS/DMI data

• KernelIPCBridge — Direct communication with PhantomSensor.sys for kernel-assisted analysis
• ResultConverter — Translates emulation results to unified detection events
• EmulationSession — Orchestrates full sample analysis with timeout and resource limits

Status: in development

A from-scratch x86/x64 instruction decoder being built to replace the Zydis third-party dependency, with the goal of zero external dependencies for instruction-level analysis across the platform. The PhantomEmulator's existing decoder — including VEX/EVEX/AVX-512 support — serves as the foundation.

The user-mode malware hunting engine, shared by all three product tiers (Home, EDR, XDR). 23 module families comprising the detection, protection, and intelligence stack:

526 distinct ATT&CK technique IDs — 193 base techniques plus sub-techniques — are referenced across the kernel sensor and the user-mode detection sources, so detections carry T-ID attribution for SOC integration. This measures attribution coverage in the detection logic; it is not a benchmarked efficacy claim per technique.

All three tiers share the same kernel sensor, detection engines, AI models, and emulation engine. Product differentiation happens at the orchestration, UI, and management layers.

⚠️ The codebase is under active development and not yet packaged for external builds. Full build instructions will be provided when the project reaches beta.

Requirements:

• Visual Studio 2022 with C++23 support (MSVC v143)
• Windows Driver Kit (WDK) 10.0.22621.0+
• Windows SDK 10.0.22621.0+
• Python 3.10+ with PyTorch (for PhantomCortex training only)
• Test environment: Windows 10/11 x64 VM with Driver Verifier enabled

Quick build (user-mode only):

MSBuild.exe ShadowStrike.sln /p:Configuration=Release /p:Platform=x64 /t:ShadowStrike /m

Full build (includes kernel driver — requires WDK):

MSBuild.exe ShadowStrike.sln /p:Configuration=Release /p:Platform=x64 /m

ShadowStrike/
├── PhantomSensor/              # Kernel driver — WDM minifilter, 20 detection subsystems
│   └── PhantomSensor/
│       ├── Behavioral/         # MITRE engine · Threat scoring · IOC matching
│       ├── Callbacks/          # Process · Thread · Image · Registry · FS callbacks
│       ├── Communication/      # Kernel↔user-mode IPC port
│       ├── Memory/             # VAD tracking · Injection detection · ROP/shellcode
│       ├── Network/            # WFP filters · C2/DGA/exfil detection
│       ├── Syscall/            # Direct syscall · Heaven's Gate · Hell's Gate
│       ├── SelfProtection/     # Anti-tamper · Callback guard · Integrity
│       ├── Sync/               # Thread pool · Timer · Work queue · DPC
│       └── ...                 # 20 subsystem folders total
│
├── PhantomEmulator/            # Custom x86/x64 emulation engine
│   ├── Core/                   # CPU · Memory · JIT · PE Loader · Threading
│   │   ├── CPU/                # Instruction decoder · Executor (15 categories)
│   │   ├── Memory/             # Virtual memory manager · Memory tracker
│   │   ├── Loader/             # PE/shellcode loading · Import/export resolution
│   │   └── Threading/          # Cooperative scheduler · Sync primitives
│   ├── WinAPI/                 # 10 DLLs · 90+ API handlers
│   ├── VirtualOS/              # Virtual FS · Registry · Network · Anti-evasion
│   ├── Analysis/               # 12 analyzers · Behavior · Crypto · MITRE · IOC
│   ├── Integration/            # Kernel IPC bridge · Session · Result converter
│   └── Common/                 # Types · Config · Constants · Errors
│
├── PhantomCortex/              # AI/ML training pipeline (Python)
│   └── training/
│       ├── models/             # 5 model architectures (LightGBM, CNN, GRU, MLP, AE)
│       ├── features/           # Feature extraction pipeline
│       ├── feeds/              # 6 threat intel feed integrators
│       ├── data/               # Dataset generators · EMBER loader
│       ├── evaluation/         # Model evaluation · Metrics
│       └── export/             # ONNX export · Quantization
│
├── src/
│   └── PhantomCore/            # User-mode detection infrastructure, 23 module families
│       ├── AI/                 # C++ inference bridge → PhantomCortex models
│       ├── Core/               # Engine · FileSystem · Network · Process · Registry · System
│       ├── RealTime/           # RTP · Exploit prevention · Behavior blocking
│       ├── AntiEvasion/        # 9 evasion detection modules + ASM
│       ├── Security/           # 10 self-defense modules
│       ├── Scripts/            # 6 script analysis engines
│       ├── SignatureStore/     # B-tree · YARA · Copy-on-write
│       ├── PatternStore/       # Aho-Corasick · Boyer-Moore · SIMD
│       ├── HashStore/          # Bloom filter · Memory-mapped DB
│       ├── ThreatIntel/        # STIX 2.1 · IOC · Sharded index
│       ├── PEParser/           # Full PE32/PE32+ parser
│       ├── RansomwareProtection/ # Honeypot · VSS · Entropy · Rollback
│       ├── Performance/        # CPU · Disk · Network monitoring
│       └── ...                 # 23 module families total
│
├── include/                    # Vendored headers (YARA · SQLiteCpp · tlsh)
├── vendor/                     # Vendored libraries
├── tests/                      # Unit · integration · fuzz · contract tests
├── malware_tests/              # Malware sample testing framework
└── docs/                       # Architecture documentation

A deliberate design goal is a small, permissively licensed dependency set: the supply chain of a security product is part of its attack surface, and every third-party component in a Ring-0-adjacent product is something a user would otherwise have to audit separately.

There are no GPL dependencies.

Platform APIs used directly rather than through a wrapper: Windows Filter Manager (WDK), CNG/BCrypt, WinVerifyTrust, AMSI, Windows Filtering Platform, and ETW.

The contract tests exist because the most dangerous regressions in a security product are not crashes — they are a detector quietly becoming less precise, or a trust decision silently widening. Each one pins an invariant to the source and is validated by mutation: the invariant is deliberately broken, and the test that must fail is required to be the only one that does.

An alpha under active development. A security product that is vague about its own gaps is asking for trust it has not earned, so this is the current state of what is and is not finished.

Not yet shipped to endpoints

• ML models. The inference bridge is wired into the scan pipeline and four models are trained, but the models are not packaged into the installer and there is no signed model distribution yet, so ML detection is inactive on an installed endpoint.
• Detection content is thin. The shipped database carries 11,053 YARA rules, but the malware hash section holds only EICAR test hashes. Most public malware-hash feeds are licensed for non-commercial use only, which constrains what this project may redistribute; hash content is therefore user-supplied via the updater for now.

Verified working, still hardening

• False positives on signed binaries. Publisher trust is now evaluated at the script-conviction, remediation, registry-write and file-enumeration decision points, each change shipped with contract tests that fail if a detector is weakened rather than made more precise. Remaining false positives are being worked through against field evidence from live endpoints.
• Kernel IPC frame robustness. The encrypted kernel channel is established and carrying scan traffic, but a fraction of frames currently fail integrity checks and are answered fail-open. Every such frame is an unscanned file, and this is treated as a correctness defect, not a performance one.
• Cloud-backed files. Files stored as OneDrive placeholders are currently unreadable by the scanner and are not yet distinguishable from scanned files in the statistics.

Infrastructure and process

• Kernel testing cannot be automated. No CI system can load a kernel driver, so integration verification runs as build-deploy-test cycles against real Windows endpoints, analysed from service logs and kernel traces.
• Static analysis coverage is partial. The Coverity result of 0.25 defects/KLoC applies to the kernel sensor; extending the same analysis across every source tree is outstanding work.
• No independent security review or third-party detection benchmark. Neither has been funded or performed.
• Driver signing. Distribution to end users without disabling Secure Boot requires Microsoft attestation/WHQL signing, which is not yet in place.

Please read CONTRIBUTING.md before submitting anything.

To report a vulnerability, do not open a public GitHub issue. See SECURITY.md for the private disclosure process.

GNU Affero General Public License v3.0 (AGPL-3.0)

Any derivative work must also be released under AGPL-3.0.

The engine stays open source. The kernel sensor, the detection engines, the emulation engine and the inference bridge are AGPL-3.0 and will remain so — auditability is the reason this project exists, and a product you cannot inspect is the thing it is meant to replace. Optional hosted services may be offered commercially around that engine in future — managed threat-intelligence feeds, fleet and threat-intel dashboards for the EDR and XDR tiers, and similar operational infrastructure. Those would be services, not a closed fork: running the platform entirely on your own infrastructure, with no external dependency and no feature held back, will always be supported.

For commercial licensing enquiries: contact@shadowstrike.dev

• The Windows Driver Kit documentation and Microsoft kernel engineering resources
• YARA — malware pattern matching engine
• The EMBER dataset by Elastic — PE feature training data
• The security research community whose published work makes open-source EDR possible
• Every open-source threat intel feed provider (abuse.ch, AlienVault OTX, MalwareBazaar)