👻 Phantom Detect — Detection Engineering from Offensive Research

"I built the weapon, then I built the shield."

Phantom Detect reads offensive tool source code, pulls behavioral indicators mapped to MITRE ATT&CK, and writes YARA + Sigma detection signatures. Feed it your own malware — it outputs the rules to catch it.

The Adversary Research Loop

Offensive Tool (BRIAR, Gauntlet, etc.)
         │
         ▼
   Phantom Detect
   ┌──────────────┐
   │ Code Analysis │ → Behavioral indicator extraction
   │ YARA Gen      │ → File/memory detection rules
   │ Sigma Gen     │ → SIEM rules (Splunk, Elastic, etc.)
   │ HTML Report   │ → Visual assessment w/ MITRE mapping
   └──────────────┘
         │
         ▼
   Detection Signatures

The pitch: "Here's my APT framework. Here's the tool that writes the signatures to catch it."

Usage

# Analyze a project and generate all signatures
python3 phantom.py --target ./my-offensive-tool/

# YARA rules only
python3 phantom.py --target ./my-offensive-tool/ --format yara

# Single file
python3 phantom.py --target ./malware_sample.py --format both

# Full HTML report
python3 phantom.py --target ./projects/malware/ --report phantom_report.html

# Combined mode — one rule per project instead of per-category
python3 phantom.py --target ./rat/ --mode combined

Behavioral Pattern Coverage

MITRE Category	Patterns	Examples
Execution	4	subprocess, os.system, exec/eval, ctypes
Persistence	3	Registry modification, scheduled tasks, startup
Defense Evasion	7	Base64, XOR, encryption, anti-debug, sandbox detection, polymorphism, process injection
Credential Access	3	Credential dumping, keyloggers, browser credential theft
Command & Control	4	Raw sockets, reverse shells, C2 beacons, DNS tunneling
Exfiltration	1	Data exfiltration over C2
Collection	1	Screen capture
Lateral Movement	2	Pass-the-hash, self-propagation
Discovery	1	Network scanning

30+ detection patterns across 9 MITRE ATT&CK categories.

Architecture

phantom-detect/
├── phantom.py              # CLI entrypoint
├── analyzers/
│   └── code_analyzer.py    # Behavioral analysis (30+ patterns)
├── generators/
│   ├── yara_gen.py         # YARA rule generation
│   └── sigma_gen.py        # Sigma rule generation
├── reports/
│   └── generator.py        # HTML report generator
├── signatures/             # Generated output
│   ├── *.yar               # YARA rules
│   └── sigma/*.yml         # Sigma rules
└── README.md

Requirements

Zero external dependencies. Python 3.10+ stdlib only.

Output Formats

• YARA — File-level detection rules with string matching and behavioral conditions
• Sigma — SIEM-compatible rules for Splunk, Elastic, QRadar, Azure Sentinel
• HTML — Visual report with indicator tables, severity scoring, and embedded signatures

Authors

Jaret Bottoms + Orion — Adversary Research Engineer 🔧