News for hackers. Stuff that matters.

Show HN: Open-Source ShadowStrike Phantom EDR/XDR Platform Progress-Post

ShadowStrike Phantom is a Open-Source Endpoint Protection Platform at Github.

Mainly we will have 3 product tiers | |->ShadowStrike Phantom Shared Modules(PhantomCore + PhantomEmulator/disassembler + PhantomCortex AI/ML models + PhantomSensor(kernel driver)) |+ |->Phantom Home(For mostly home users - will have a local UI to control the Antivirus and will have some extra stuff like privacy - gamemode etc. For home-users) | |->Phantom EDR(For the Endpoints - will have the local web dashboard For Community Enterprise-users + Endpoint-specific additional protections + forensics) | |->Phantom XDR(Extended detection for endpoints - will include SIEM Integrations etc. Every related-stuff will be added to this product)

Community/EDR-XDR-Home products will be able to work locally at the Host Machine. And we are planning to do Phantom Pro - Phantom Enterprise products that will include cloud-based systems - Global Threat Intelligence - Online Web Threat Intel Dashboards For companies etc. stuff.[Of course, we need capital to do these things, so they are part of our long-term plan.]

Currently We are mostly extracting the Attack surface-map of the ShadowStrike Phantom and Fuzzing it with our harnesses - Integration/Unit tests - Coverity/PVS-Studio scans - Working with the Product Splits and their own additional protection features - Bugfixes - Security Vulnerabilities - Kernel BSODs. Pretty much everything...

If you are interested in the Open-Source Endpoint Detection and Response/Extended detection and Response/Antivirus Systems and Kernel Stuff and lots of C/C++:

Github : https://github.com/ShadowStrike-Labs/ShadowStrike

( 3 comments | on HN )
Re:Show HN: Open-Source ShadowStrike Phantom EDR/XDR Platfor... by kilakulusu on Friday April 17, 2026 @09:50AM (#47805945)
kernel-level security product - are you targeting windows or linux? on windows the driver signing requirements are brutal, most projects hit a wall there. curious how you plan to handle that or if you are focused on linux server deployments instead
Re:Show HN: Open-Source ShadowStrike Phantom EDR/XDR Platfor... by Soocile on Friday April 17, 2026 @01:08PM (#47808144)
Targeting Windows 10/11 x64-bit operating systems. And you are right windows driver signing requirements are brutal. I plan to overcome this barrier by securing investment from foundations (like NLNet, etc.) and institutions. The kernel-driver now works we have tested it via vmware workstation pro at driver test signing mode with driver verifier flags enabled.[Still though some edge-cases may be occur] So the kernel-sensor is ready for deployment now we are mostly working with the PhantomEDR - XDR - Home product splits - additional features for home users and more various protection features for endpoints. We'll see how things progress - Stay in contact.
Re:Show HN: Open-Source ShadowStrike Phantom EDR/XDR Platfor... by Soocile on Friday April 17, 2026 @01:09PM (#47808169)
Unless an unexpected problem arises, we plan to release it on the first day of 2027.