ShadowStrike Labs
An independent security engineering lab. We build defensive software for Windows, and tools for analysing the malware it defends against.
01What we do
Defensive software, and the tools behind it.
02Principles
The rules we build by.
- 01
Auditable by default
The kernel sensor, the detection engine and every edition are published under AGPL-3.0. The rule that flagged a file is a rule you can read.
- 02
No hidden telemetry
Every network call Phantom makes is in the source. Nothing leaves a machine that you cannot find in the code.
- 03
Limits in writing
Known limitations are documented in the repository, next to the code, instead of being discovered in production.
- 04
A short supply chain
No GPL dependencies, and every third-party component is one we can account for. In a security product the supply chain is attack surface.
- 05
Faster never means blinder
An optimisation that costs detection is a regression. A false positive is fixed by making the detector precise, not by deleting it.
03How we work
In public, and verified on real machines.
Phantom is developed on GitHub where anyone can follow it. Issues and discussions are public; vulnerability reports are not, and follow the disclosure policy.
No continuous-integration service can load a kernel driver, so kernel changes are verified on isolated Windows test machines with Driver Verifier enabled, and judged from service logs and kernel traces.
Contributions are welcome. Read the contributing guide before you start: it explains the review process and the copyright terms that apply to anything submitted.
04Support the work
Help keep endpoint security open.
If you want auditable endpoint protection to exist, you can sponsor its development on GitHub.
05Contact
Licensing, collaboration, research or press.
Write to contact@shadowstrike.dev or use the contact form.