{"adoption": {"forks": 305, "observed_at": "2026-08-28T04:05:39.672021+00:00", "stars": 1812}, "canonical_url": "https://ross.abutalabs.com/products/phant0m", "card": {"archived": true, "artifact_type": "cli-tool", "description": "Windows Event Log Killer", "domain": ["security", "penetration-testing", "windows"], "enriched": true, "function": ["security", "penetration-testing"], "health_score": 10, "homepage": null, "language": "C", "license": null, "license_family": "other", "maturity": "maintenance", "member_repos": ["hlldz/Phant0m"], "name": "hlldz/Phant0m", "platform": ["windows", "cli"], "pushed_at": "2023-09-21T16:08:18+00:00", "repo": "hlldz/Phant0m", "stars": 1812, "tags": ["offensive-security", "red-team", "event-log", "defense-evasion", "cobalt-strike", "reflective-dll", "powershell", "c2", "command-line"], "topics": ["powershell", "windows", "eventlog", "eventlog-service", "cpp", "reflective-dll", "cobalt-strike"], "urls": [], "use_cases": ["stop windows event logging during a red team engagement", "kill event log service threads without stopping the process", "evade detection by disabling windows event logs", "integrate log-killing capability into cobalt strike via reflective dll", "test blue team detection of event log tampering"], "what_it_is": "Phant0m is a Windows Event Log Killer that identifies the process hosting the Windows Event Log service and terminates only its threads, so logging stops while the service appears to be running. It is written in C, supports multiple PID detection (SCM/WMI) and thread-killing techniques, and can be used standalone or via reflective DLL loading in tools like Cobalt Strike.", "when_to_avoid": ["you need to legitimately manage or configure Windows Event Logs", "you require a licensed or supported tool for production environments", "you are on a non-Windows platform"], "when_to_choose": ["you are a red teamer needing to halt Windows event log collection while keeping the service process alive", "you want a configurable tool with multiple PID detection and thread-kill techniques", "you need in-memory execution via reflective DLL injection from a C2 framework"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/phant0m", "repo": "hlldz/Phant0m", "role": "main", "score": 10}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:05:39.672021+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T03:21:13.037440+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c2ae798ac28bdb240d11a6e404a367a18a5d4e3e7247cc52252d93ce2258f665", "fetched_at": "2026-08-28T04:05:39.672021+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hlldz/Phant0m"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:05:39.672021+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T03:21:13.037440+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c2ae798ac28bdb240d11a6e404a367a18a5d4e3e7247cc52252d93ce2258f665", "fetched_at": "2026-08-28T04:05:39.672021+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hlldz/Phant0m"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T03:21:13.037440+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c2ae798ac28bdb240d11a6e404a367a18a5d4e3e7247cc52252d93ce2258f665", "fetched_at": "2026-08-28T04:05:39.672021+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hlldz/Phant0m"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:05:39.672021+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:05:39.672021+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:05:39.672021+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T03:21:13.037440+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c2ae798ac28bdb240d11a6e404a367a18a5d4e3e7247cc52252d93ce2258f665", "fetched_at": "2026-08-28T04:05:39.672021+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hlldz/Phant0m"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:05:39.672021+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:05:39.672021+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T03:21:13.037440+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c2ae798ac28bdb240d11a6e404a367a18a5d4e3e7247cc52252d93ce2258f665", "fetched_at": "2026-08-28T04:05:39.672021+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hlldz/Phant0m"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:05:39.672021+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:05:39.672021+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:05:39.672021+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T03:21:13.037440+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c2ae798ac28bdb240d11a6e404a367a18a5d4e3e7247cc52252d93ce2258f665", "fetched_at": "2026-08-28T04:05:39.672021+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hlldz/Phant0m"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:05:39.672021+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:05:39.672021+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T03:21:13.037440+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c2ae798ac28bdb240d11a6e404a367a18a5d4e3e7247cc52252d93ce2258f665", "fetched_at": "2026-08-28T04:05:39.672021+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hlldz/Phant0m"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T03:21:13.037440+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c2ae798ac28bdb240d11a6e404a367a18a5d4e3e7247cc52252d93ce2258f665", "fetched_at": "2026-08-28T04:05:39.672021+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hlldz/Phant0m"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T03:21:13.037440+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c2ae798ac28bdb240d11a6e404a367a18a5d4e3e7247cc52252d93ce2258f665", "fetched_at": "2026-08-28T04:05:39.672021+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hlldz/Phant0m"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T03:21:13.037440+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c2ae798ac28bdb240d11a6e404a367a18a5d4e3e7247cc52252d93ce2258f665", "fetched_at": "2026-08-28T04:05:39.672021+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hlldz/Phant0m"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": ["no_releases", "archived", "no_license"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3410, "days_push": 1077, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 10, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}