ShadowStrike Phantom
ShadowStrike just hit 20 on GitHub.Still early, still evolving.Building something powerful step by step.Appreciate everyone checking it out : https://github.com/ShadowStrike-Labs/ShadowStrike
Soocile
ShadowStrike-Phantom Open-Source Endpoint Protection Platform
Github : https://github.com/ShadowStrike-Labs/ShadowStrike
Re:ShadowStrike-Labs: ShadowStrike Phantom Home UI
on Thursday April 23, 2026 @06:57AM (#47874229)
Feel free to share your thoughts and suggestions.
ShadowStrike-Labs: ShadowStrike Phantom Home UI
As ShadowStrike-Labs we are thinking of releasing the ShadowStrike Phantom Home Products at the first stage and then EDR after that XDR. Now we are mostly trying to make the UI for the Home users & testing on the VM - Fixing when the BSOD occurs using kernel debugger(kd.exe) - windbgx64. There are still a lot work to get done :1)Make the UI stable with all the wirings to the PhantomCore...
Re:Show HN: Open-Source ShadowStrike Phantom EDR/XDR Platform Progress...
on Friday April 17, 2026 @01:09PM (#47808169)
Unless an unexpected problem arises, we plan to release it on the first day of 2027.
Re:Show HN: Open-Source ShadowStrike Phantom EDR/XDR Platform Progress...
on Friday April 17, 2026 @01:08PM (#47808144)
Targeting Windows 10/11 x64-bit operating systems. And you are right windows driver signing requirements are brutal. I plan to overcome this barrier by securing investment from foundations (like NLNet, etc.) and institutions. The kernel-driver now works we have tested it via vmware workstation pro at driver test signing mode with driver verifier flags enabled.[Still though some edge-cases may be occur] So the kernel-sensor is ready for deployment now we are mostly working with the PhantomEDR - XDR - Home product splits - additional features for home users and more various protection features for endpoints.
We'll see how things progress - Stay in contact.
Show HN: Open-Source ShadowStrike Phantom EDR/XDR Platform Progress-Post
ShadowStrike Phantom is a Open-Source Endpoint Protection Platform at Github.Mainly we will have 3 product tiers | |->ShadowStrike Phantom Shared Modules(PhantomCore + PhantomEmulator/disassembler + PhantomCortex AI/ML models + PhantomSensor(kernel driver)) |+ |->Phantom Home(For mostly home users - will have a local UI to control the Antivirus and will have some extra stuff like privacy...
ShadowStrike Phantom: Open-Source EDR/XDR Platform
We've been developing ShadowStrike Phantom since 2024 and plan to release it on Day 1 of 2027. Here's what we've accomplished so far:Phantom Emulator - A fully X86-64 Special Emulation Engine for advanced obfuscated malwaresPhantom Cortex - Includes Cortex-Static , Cortex-Behavioral ,Cortex-Network , Cortex-Emulation and the Cortex-Memory. We have been trained 5 of those AI/ML models with the...
Re:Show HN: ShadowStrike EDR/XDR Kernel Sensor Development
on Friday March 20, 2026 @02:16AM (#47451126)
Built from scratch - custom kernel minifilter with 70+ modules, behavioral engine with attack chain tracking , MITRE ATT&CK mapping and ETW Telemetry. Most of EDRs Kernel sensor is closed. Our kernel sensor and the usermode-agents fully open-source right now.(PhantomEDR PhantomXDR PhantomHome).
Show HN: ShadowStrike EDR/XDR Kernel Sensor Development
I've been building an open-source kernel-mode EDR/XDR sensor called Phantom Sensor for about two years now as a solo project. It just hit a milestone I'm pretty excited about - the driver loads cleanly on Windows 11, passes Driver Verifier with all standard flags enabled, and survives normal use without crashing.The kernel sensor (PhantomSensor) is a WFP+minifilter driver sitting at altitude...
Show HN: ShadowStrike – Windows EDR Post-Analysis
Today is a big day. Finally the PhantomSensor the Kernel driver of our ShadowStrike EDR/XDR platform completely finished.We ran the analysis through the best static analysis tools on the market (PVS-Studio + Coverity), then through Microsoft's CodeQL (formerly SDV). I've been working on this for days, 15-16 hours a day, and now these analyses are finally complete.[Coverity Dashboard...
Re:Show HN: ShadowStrike – building an open-source EDR from scratch
on Sunday February 15, 2026 @02:23PM (#47026578)
First of all, it's great to receive such feedback from a system architect like yours! Thank you for that. I'm trying my best; it will be a long-term project, and I'm considering a serious EDR platform. As you said, I'm planning endpoint cloud systems and even custom sandbox - AI integrations for these cloud systems, but these require money, and I can't afford them right now. Also, the product is still in its early stages and has a long way to go, but I will definitely try to add them in the future. As someone familiar with EDRs, I know them inside and out. I'm also thinking of adding systems like threat management dashboards, but if I do that, I'll probably have to release it as an Enterprise version of ShadowStrike, but as I said, these are things that will happen over time. This year, I'm completely focused on Shadow Sensor; it's a really challenging area, and I'm learning a lot while trying to do a good job. Let's see how things go.
Show HN: ShadowStrike – building an open-source EDR from scratch
https://github.com/Soocile/ShadowStrike
For the past two years I’ve been working on a long-term project called ShadowStrike, an experimental endpoint detection and response engine written mostly in C/C++ with some x86-64 assembly components.This project is still pre-alpha. It does not compile yet, the codebase is large and messy, and many components are under heavy refactoring. I’m sharing it early because I’d rather build in public...