awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
oddcod3 avatar

oddcod3/Phantom-EvasionArchived

0
View on GitHub↗

Phantom Evasion

Phantom-Evasion is a security research framework designed for generating obfuscated payloads and automating post-exploitation tasks during authorized security assessments. It provides a suite of utilities for creating custom executables and libraries intended to test the effectiveness of antivirus and endpoint security detection systems.

The framework distinguishes itself through a focus on memory-resident operations, allowing for the execution of encrypted binaries and shellcode directly within system memory. By utilizing techniques such as junk code injection, payload encryption, and remote resource fetching, it minimizes the forensic footprint on a target machine and avoids reliance on disk-based storage.

Beyond payload generation, the tool includes capabilities for maintaining long-term system access through the configuration of registry keys, scheduled tasks, and background services. It also supports stealthy operations by injecting shellcode into legitimate system processes and automating administrative tasks, such as managing security logging drivers and process memory, to facilitate controlled penetration testing scenarios.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI

Features

  • Memory-Only Execution - Provides a framework for fetching and loading encrypted binaries directly into system memory to avoid writing files to the local disk.
  • In-Memory Payload Execution - Loads encrypted binaries directly into process memory to bypass disk-based security scanning and forensic file analysis.
  • Red Team Workflow Automations - Automates administrative tasks and maintains stealthy access on a compromised system during authorized security assessments.
  • Obfuscation Junk Code Injection - Inserts non-functional instructions into the executable structure to alter file signatures and evade static pattern-based detection.
  • Registry Persistence - Establishes system persistence by generating payloads that maintain access to a target machine through registry keys, scheduled tasks, or background services.
  • Security Persistence Managers - Establishes long-term access to a target machine by configuring background services and registry modifications for authorized security testing scenarios.
  • Encrypted Shellcode Injection - Performs process shellcode injection by executing custom shellcode within local or remote processes using memory allocation and execution techniques.
  • Shellcode Injection Wrappers - Injects and executes custom shellcode within local or remote processes to maintain stealth during security operations.
  • Process Space Injection - Executes custom shellcode within the memory space of legitimate system processes to maintain stealth and evade detection.
  • Payload Obfuscators - Applies encryption and polymorphic transformations to executable code at generation time to prevent signature-based antivirus identification.
  • Post-Exploitation Toolkits - Automates post-exploitation tasks, including dumping process memory, hiding files, and disabling security logging drivers.
  • Memory-Resident Remote Execution - Enables remote execution by fetching and loading encrypted executables or libraries directly into memory from a remote source.
  • Post-Exploitation Tools - Executes administrative tasks and maintains system persistence on compromised machines through memory-resident operations.
  • Security Payload Generators - Creates custom executable files and libraries with obfuscation techniques to test the effectiveness of antivirus and endpoint security detection systems.
  • Persistence Orchestrators - Modifies operating system configuration hooks like registry keys and scheduled tasks to ensure automatic re-execution after system reboots.
1,449 stars·342 forks·Python·gpl-3.0·28 views

Star history

Star history chart for oddcod3/phantom-evasionStar history chart for oddcod3/phantom-evasion

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

Frequently asked questions

What does oddcod3/phantom-evasion do?

Phantom-Evasion is a security research framework designed for generating obfuscated payloads and automating post-exploitation tasks during authorized security assessments. It provides a suite of utilities for creating custom executables and libraries intended to test the effectiveness of antivirus and endpoint security detection systems.

What are the main features of oddcod3/phantom-evasion?

The main features of oddcod3/phantom-evasion are: Memory-Only Execution, In-Memory Payload Execution, Red Team Workflow Automations, Obfuscation Junk Code Injection, Registry Persistence, Security Persistence Managers, Encrypted Shellcode Injection, Shellcode Injection Wrappers.

Which projects share features with oddcod3/phantom-evasion?

Projects with overlapping indexed features include: samratashok/nishang — Nishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows… trickster0/offensiverust — OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and… zer0yu/awesome-cobaltstrike — This project is a curated collection of tools, scripts, and technical guides designed to enhance offensive security… bishopfox/sliver — Sliver is a command and control framework designed for adversary emulation and security assessment operations. It… hackerschoice/thc-tips-tricks-hacks-cheat-sheet — This project is a comprehensive command-line reference and toolkit designed for Linux system administration and… lolbas-project/lolbas — LOLBAS is a curated database and knowledge base of signed Windows binaries that can be misused to bypass security…

Projects sharing features with Phantom Evasion

These projects share indexed features with Phantom Evasion. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • samratashok/nishangsamratashok avatar

    samratashok/nishang

    9,951View on GitHub↗

    Nishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows targets. It functions as a post-exploitation toolkit and payload generator to automate attacks and manage remote targets. The project provides specialized capabilities for bypassing security controls, such as disabling the Antimalware Scan Interface and employing in-memory execution to avoid disk-based detection. It includes a variety of stealthy command and control mechanisms, utilizing non-standard channels like DNS TXT records, ICMP traffic, and webmail for communication a

    PowerShellactivedirectoryhackinginfosec
    View on GitHub↗9,951
  • trickster0/offensiverusttrickster0 avatar

    trickster0/OffensiveRust

    2,984View on GitHub↗

    OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and post-exploitation library, providing a collection of offensive security primitives and a Windows API wrapper for interacting with low-level system functions and undocumented APIs. The project focuses on bypassing security software through direct system calls, memory obfuscation, and stealthy payload execution. It implements techniques to defeat static binary analysis via compile-time string encryption and payload obfuscation, while avoiding detection using parent process ID s

    Rust
    View on GitHub↗2,984
  • zer0yu/awesome-cobaltstrikezer0yu avatar

    zer0yu/Awesome-CobaltStrike

    4,468View on GitHub↗

    This project is a curated collection of tools, scripts, and technical guides designed to enhance offensive security operations using Cobalt Strike. It serves as a resource hub for managing command and control infrastructure and deploying security engagements. The collection includes toolkits for evading endpoint detection and response systems, alongside libraries for automating red team tasks such as reconnaissance and host enumeration. It provides resources for developing post-exploitation frameworks, specifically focusing on the creation of reflective libraries and memory-resident code. Th

    View on GitHub↗4,468
  • bishopfox/sliverBishopFox avatar

    BishopFox/sliver

    12,264View on GitHub↗

    Sliver is a command and control framework designed for adversary emulation and security assessment operations. It provides a centralized platform for managing remote systems, enabling security professionals to coordinate multi-operator sessions and maintain persistent, secure communication channels across diverse network environments. The framework distinguishes itself through its focus on stealth and infrastructure flexibility. It utilizes dynamic payload obfuscation to generate unique binaries and supports in-memory execution to minimize disk artifacts. Communication is secured through mutu

    Goadversarial-attacksadversary-simulationc2
    View on GitHub↗12,264
Compare all 30 related projects→