# hlldz/Phant0m

Windows Event Log Killer

Repository: https://github.com/hlldz/Phant0m
Canonical: https://ross.abutalabs.com/products/phant0m
Language: C
License Family: other
Topics: powershell, windows, eventlog, eventlog-service, cpp, reflective-dll, cobalt-strike
Archived: true
Last push: 2023-09-21T16:08:18+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3410, "days_push": 1077, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, archived, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1812, forks 305 (observed 2026-08-28T04:05:39.672021+00:00)

## What it is
Phant0m is a Windows Event Log Killer that identifies the process hosting the Windows Event Log service and terminates only its threads, so logging stops while the service appears to be running. It is written in C, supports multiple PID detection (SCM/WMI) and thread-killing techniques, and can be used standalone or via reflective DLL loading in tools like Cobalt Strike.

## Use cases
- stop windows event logging during a red team engagement
- kill event log service threads without stopping the process
- evade detection by disabling windows event logs
- integrate log-killing capability into cobalt strike via reflective dll
- test blue team detection of event log tampering

## When to choose
- you are a red teamer needing to halt Windows event log collection while keeping the service process alive
- you want a configurable tool with multiple PID detection and thread-kill techniques
- you need in-memory execution via reflective DLL injection from a C2 framework

## When to avoid
- you need to legitimately manage or configure Windows Event Logs
- you require a licensed or supported tool for production environments
- you are on a non-Windows platform

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, penetration-testing
- domain: security, penetration-testing, windows
- platform: windows, cli
- tags: offensive-security, red-team, event-log, defense-evasion, cobalt-strike, reflective-dll, powershell, c2, command-line

## Member repositories
- hlldz/Phant0m (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:39.672021+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:21:13.037440+00:00, confidence not recorded.
  - readme: https://github.com/hlldz/Phant0m (fetched 2026-08-28T04:05:39.672021+00:00, sha c2ae798ac28b)
- Data as of 2026-08-30T08:39:29.467469+00:00.