Ghost

Ghost is a process injection detection tool written in Rust. It watches running processes and tries to catch suspicious stuff like code injection, memory manipulation, and other tricks that malware uses to hide.

The main idea is simple: scan processes and look for weird memory patterns, hooked functions, shellcode, and other signs that something's been tampered with. It works on Windows, Linux, and macOS (though Windows support is the most complete right now).

Some of the things it can detect:

• Memory regions with read-write-execute permissions - Usually a red flag
• Shellcode patterns - Common instruction sequences found in injected code
• Process hollowing - When a legit process gets gutted and replaced with malicious code
• API hooks - Functions that have been redirected by inline patches or IAT modifications
• Thread hijacking - Threads that are redirected to execute shellcode
• APC injection - Malicious code queued via Asynchronous Procedure Calls
• YARA signatures - Matches against known malware patterns and payloads

It also maps detected behaviors to the MITRE ATT&CK framework, which is helpful if you're documenting threats or writing reports.

Results stream in as each process is analyzed, with live progress in the title bar ([scanning N/M]).

You'll need Rust installed (1.70 or newer). Then:

cargo build --release

On Windows, you'll also need the MSVC build tools. Linux needs basic dev tools (gcc, etc.). macOS needs Xcode command line tools.

There are two interfaces: a command-line tool and an interactive terminal UI.

CLI:

# Scan all processes
cargo run --bin ghost-cli --release

# Target one process
cargo run --bin ghost-cli --release -- --pid 1234

# Output results as JSON
cargo run --bin ghost-cli --release -- --format json

# Use a config file
cargo run --bin ghost-cli --release -- --config ghost.toml

# Continuous monitoring mode
cargo run --bin ghost-cli --release -- --watch

# Watch with custom interval (10 seconds)
cargo run --bin ghost-cli --release -- --watch --interval 10

TUI:

cargo run --bin ghost-tui --release

The TUI has six tabs: Overview, Processes, Detections, Threat Intel, Memory, and Logs. A scan runs in the background and results stream in live as each process is analyzed, with [scanning N/M] progress shown in the header.

Keybindings:

• Tab / Shift+Tab or Left/Right - switch tabs
• Up/Down - navigate the list on the current tab (selection is highlighted with >>)
• Enter - view details for the selected process (Processes tab)
• R - trigger a rescan
• C - clear the current tab's data (detections on Overview/Detections, logs on Logs)
• Q - quit

Esc is deliberately not bound to quit - some terminals deliver stray Escape bytes from focus or OSC sequences, which would otherwise close the app unexpectedly.

Ghost supports tab completion for Bash, Zsh, Fish, PowerShell, and Elvish.

# Generate completions for your shell
ghost completions bash > /etc/bash_completion.d/ghost
ghost completions zsh > ~/.zfunc/_ghost
ghost completions fish > ~/.config/fish/completions/ghost.fish

# Or use the install script
./completions/install.sh

See completions/README.md for detailed installation instructions.

Ghost supports optional features that can be enabled during build:

# YARA rule scanning (requires libyara)
cargo build --features yara-scanning

# Neural ML integration (requires Python and trained models)
cargo build --features neural-ml

# eBPF detection (Linux only, currently stub implementation)
cargo build --features ebpf-detection

Note: ML features require trained models to function. See ghost_ml/README.md for training instructions.

You can tweak behavior with a TOML config file. Check examples/ghost.toml for a starting point. You can enable/disable specific detection methods, set confidence thresholds, skip system processes, and control how often it scans.

Example config snippet:

shellcode_detection = true
hollowing_detection = true
hook_detection = true
confidence_threshold = 0.3
skip_system_processes = true
scan_interval_ms = 2000

By default, Ghost limits output to 10 indicators per detection and deduplicates similar findings. For large scans, you can further reduce output:

Command-line options:

# Summary mode - outputs statistics instead of full details
ghost-cli --summary

# Limit indicators per detection
ghost-cli --max-indicators 5

# Only report malicious detections
ghost-cli --min-threat-level malicious

# Combine for minimal output
ghost-cli --summary --quiet

Configuration file:

[output]
verbosity = "minimal"          # minimal, normal, or verbose
max_indicators_per_detection = 5
min_threat_level = "suspicious"
deduplicate_indicators = true
summary_mode = true

This is useful when scanning many processes or running continuous monitoring where output files would otherwise grow too large.

Watch mode lets you monitor your system continuously without having to run scans manually. It's useful for catching injection attempts as they happen.

# Start watching (default: 5 second interval)
ghost-cli --watch

# Custom interval
ghost-cli --watch --interval 10

# Watch specific process
ghost-cli --watch --pid 1234

# Quiet mode - only alerts on new detections
ghost-cli --watch --quiet

When running in watch mode, Ghost:

• Shows only new detections (ones it hasn't seen before)
• Displays color-coded threat levels (red for malicious, yellow for suspicious)
• Prints timestamps with each scan cycle
• Gracefully shuts down on Ctrl+C

Example output:

[14:32:15] Scan #1: clean (142 processes, 89ms)
[14:32:20] Scan #2: 2 NEW detections! (2 total, 142 processes, 91ms)
  [MALICIOUS] suspicious.exe (PID: 4521) - 87% confidence
  [SUSPICIOUS] helper.dll (PID: 2201) - 54% confidence
[14:32:25] Scan #3: 2 known threats (142 processes, 88ms)

Baseline mode captures a snapshot of your system's current state. Later scans can compare against this baseline to detect changes - useful for finding new threats without wading through known issues.

# Save current state as baseline
ghost-cli --save-baseline baseline.json

# Later: compare against baseline
ghost-cli --baseline baseline.json

# Combine with watch mode
ghost-cli --watch --baseline baseline.json

When comparing against a baseline, Ghost reports:

• New threats: Processes not in the baseline
• Escalated threats: Processes whose threat level increased
• New indicators: Known processes with new suspicious behaviors

Example output:

3 changes from baseline:

  New threats (1):
    injector.exe (PID: 8821) - Malicious

  Escalated threats (1):
    helper.dll (PID: 2201): Suspicious -> Malicious

  New indicators (1):
    svchost.exe (PID: 1024):
      - RWX memory region detected
      - Shellcode pattern match

Exit code is 1 if changes are detected, 0 if clean.

Ghost can send real-time alerts to Slack, Discord, or any HTTP endpoint when threats are detected. Perfect for SOC integration or getting notified on your phone.

# Slack webhook
ghost-cli --watch --webhook "https://hooks.slack.com/services/XXX/YYY/ZZZ"

# Discord webhook
ghost-cli --watch --webhook "https://discord.com/api/webhooks/123/abc"

# Generic HTTP POST (JSON payload)
ghost-cli --watch --webhook "https://your-siem.example.com/api/alerts"

# Override auto-detected type
ghost-cli --webhook "https://custom.url" --webhook-type slack

Ghost auto-detects the webhook type from the URL:

• hooks.slack.com → Slack format with attachments
• discord.com/api/webhooks → Discord format with embeds
• Everything else → Generic JSON payload

Slack alerts include color-coded attachments (red/orange/green by threat level) with the process name, PID, top indicators, threat level, and confidence score as fields. No emoji in the payload - message text reads "Ghost detected suspicious activity on hostname".

Discord alerts use rich embeds with the same information in a clean format.

Generic webhooks send a JSON payload:

{
  "event": "ghost.detection",
  "timestamp": "2024-12-06T14:32:15Z",
  "hostname": "prod-server-01",
  "process_name": "suspicious.exe",
  "pid": 4521,
  "threat_level": "Malicious",
  "confidence": 0.87,
  "indicators": ["RWX memory region detected", "..."]
}

Ghost assigns one of three threat levels: Clean, Suspicious, or Malicious. A confidence score alone doesn't decide the verdict - Malicious additionally requires at least one high-specificity indicator (like a thread starting in unbacked executable memory), so a pile of weak, generic signals can't add up to a malicious verdict on their own. That corroboration requirement is what keeps things like JIT-heavy processes with unbacked RWX memory at Suspicious instead of Malicious.

High confidence doesn't always mean malware - some legit software does weird stuff with memory too. Use your judgment and investigate further if needed.

Windows: Fully functional. Process enumeration, memory reading, hook detection, process hollowing detection, PE validation, and thread analysis all work.

Linux: Functional core features. Process enumeration via procfs (/proc), memory reading, LD_PRELOAD detection, and ptrace-based injection detection work. eBPF support requires ebpf-detection feature flag and is currently a stub implementation.

macOS: Partial support. Process enumeration, memory region enumeration, memory reading, and thread enumeration work using mach VM APIs. Hook detection includes DYLD_INSERT_LIBRARIES detection and inline hook detection framework.

It's designed to be fast enough for continuous monitoring. A full system scan (200 processes) usually takes under 5 seconds. Memory enumeration per process is around 50-100ms. The detection engine itself adds about 5-10ms per analysis.

The tool includes YARA rule integration, built with --features yara-scanning. Rules are stored in the rules/ directory and cover common malware families like Metasploit, Cobalt Strike, generic shellcode patterns, and evasion techniques. You can add your own rules - just drop .yar files in that folder.

Ghost looks for rules in this order: the GHOST_RULES_DIR environment variable, then next to the running executable, then the current working directory.

Prebuilt release archives and the Docker image currently ship YARA support only on the x86_64-unknown-linux-gnu target - other platforms in the release matrix are built with --no-default-features and won't load rules until someone adds a proven path to a system YARA library for them.

• 0 = Everything looks clean
• 1 = Found suspicious processes
• 2 = Something went wrong (error during scan)

This is a userspace tool with the following limitations:

• Kernel-level threats: Cannot detect kernel rootkits or kernel-mode injection without kernel-level support (e.g., eBPF on Linux, which is currently a stub implementation)
• Machine learning features: Neural network analysis and behavioral ML predictions are simulated and require trained models to be functional
• Threat intelligence: The threat intelligence framework exists but has no active feed connections or IOC database
• False positives: A scan of a clean Windows 11 desktop (~330 processes) previously reported 187 processes as Malicious; the detection logic has since been reworked and that same scan now reports 0. JIT-heavy processes (browsers, some game clients) still show up as Suspicious due to unbacked RWX memory, which is a real but not inherently malicious pattern worth triage rather than a verdict
• macOS: Hook detection fully implemented with DYLD_INSERT_LIBRARIES and inline hook detection using nm-based function address resolution
• Performance claims: Documented performance metrics are targets and have not been validated through comprehensive benchmarks

There's more detail in the docs/ folder:

• DETECTION_METHODS.md - Explains how each detection technique works
• MITRE_ATTACK_COVERAGE.md - Lists which ATT&CK techniques are covered
• PERFORMANCE_GUIDE.md - Tips for tuning performance

Also check out CONTRIBUTING.md if you want to contribute, and SECURITY.md for the security policy.

MIT. See the LICENSE file.

This tool is for security research, testing your own systems, and catching actual threats. Don't use it on systems you don't own or don't have permission to test. Be responsible.

Also, if you're investigating a real incident, remember that malware can detect when it's being analyzed and might behave differently or shut down. Ghost tries to be stealthy but there's no guarantee advanced malware won't notice.