ShadowStrike Phantom
Open-source endpoint protection for Windows. A kernel sensor and a single detection engine, shared by three editions — from one personal computer to a security team's fleet.
In active development and not yet recommended for production use.
Known limitations(opens in a new tab)01Overview
Protection whose every decision can be inspected.
Phantom is written from the ground up: its own kernel driver, its own detection engine and its own emulator, rather than a licensed scanner wrapped in a new interface. That is what makes it possible to publish all of it.
The same engine runs in every edition. Phantom Home puts it behind a desktop application for personal computers; Phantom EDR and Phantom XDR add the investigation, response and correlation tools that security teams work with.
- Platform
- Windows 10 and 11, x64
- Licence
- GNU AGPL-3.0
- Stage
- Alpha
02How it works
From the kernel to a verdict, in four steps.
01Kernel
Sensor
A Windows kernel driver observes file, process, memory, registry and network activity as it happens.
02Kernel → user
Channel
Events cross into user mode over an authenticated, encrypted channel.
03User mode
Engine
One detection engine weighs signatures, behaviour and exploit patterns, and can run a suspicious sample in an emulator first.
04Home · EDR · XDR
Editions
Each edition decides what happens with a verdict, and who gets to see it.
Machine-learning models are trained but not yet shipped to endpoints, so they play no part in detection on an installed system today.
03Editions
Same engine, different jobs.
| Capability | 01Home | 02EDR | 03XDR |
|---|---|---|---|
| Kernel sensor and detection engine | Included | Included | Included |
| Real-time, exploit and ransomware protection | Included | Included | Included |
| Banking, privacy, USB and home-network guards | Included | Not included | Not included |
| Telemetry, threat hunting and incident response | Not included | Included | Included |
| Forensics and live response | Not included | Included | Included |
| Playbooks and automated response | Not included | Included | Included |
| Network, identity and email correlation | Not included | Not included | Included |
| Managed from | Desktop app | Console, in development | Console, in development |
04Licence
The engine stays open source.
Phantom is licensed under the GNU Affero General Public License v3.0. The kernel sensor, the detection engines, the emulator and the editions are published under AGPL-3.0, and the engine will remain open source — auditability is the reason the project exists.
Running Phantom entirely on your own infrastructure, with no external dependency and no feature held back, will always be supported. Optional hosted services around the engine, such as managed threat-intelligence feeds or fleet dashboards, may be offered in future.
For commercial licensing, write to contact@shadowstrike.dev.
05Status
Alpha. Phantom Home ships first.
Phantom EDR and Phantom XDR follow on the same engine. Release dates are not published — many parts move at once, and progress is visible in the repository instead.
There is no public installer yet. When builds are ready, they will be announced here and on GitHub.