Skip to content
ShadowStrikeLabs
Open source

Code from the lab.

Projects ShadowStrike Labs develops in public. Choose one for a short overview; the code, issues and documentation are on GitHub.

ShadowStrike-Labs on GitHub(opens in a new tab)

Projects · 3

Privilege ringsWindows x64
  • Ring 0 · KernelPhantom’s sensor, watching file, process, memory, registry and network activity.
  • Rings 1–2Not used by Windows.
  • Ring 3 · User modeThe detection engine and the Home, EDR and XDR editions.
  • ChannelEvents reach ring 3 over an authenticated, encrypted channel.
Fig. 01 — The sensor runs in ring 0; the engine and the editions in ring 3

01 — Repository

ShadowStrike Phantom

Endpoint protection for Windows, from the kernel up.

The complete platform in one repository: the kernel sensor, the detection engine, the emulator and the Home, EDR and XDR editions, published under AGPL-3.0.

  • Kernel sensor
  • Detection engine
  • Emulator
  • Home · EDR · XDR
Repository
ShadowStrike-Labs/ShadowStrike
Languages
C · C++ · Assembly
Licence
AGPL-3.0
Updated
Stars
45

Live from GitHub · refreshed hourly

Commits · last 52 weeks2,647
52 weeks agoThis week
git clone https://github.com/ShadowStrike-Labs/ShadowStrike.git
Open on GitHub(opens in a new tab)Phantom overview