PHANTOM KILL

You can't patch what you can't see.
3
Components
7
MITRE Techniques
3
Kill Phases
571
Tests
pip install red-specter-phantom-kill
View Docs
Every security tool tests above the OS / Scanners assume the kernel is clean / EDR assumes the bootloader is intact / A real adversary with kernel access assumes nothing / UEFI bootkits survive reinstall / Wipers destroy before defenders react / BYOVD kills EDR in kernel / You can't patch what you can't see Every security tool tests above the OS / Scanners assume the kernel is clean / EDR assumes the bootloader is intact / A real adversary with kernel access assumes nothing / UEFI bootkits survive reinstall / Wipers destroy before defenders react / BYOVD kills EDR in kernel / You can't patch what you can't see

Every Security Tool Assumes the OS Is Trustworthy. It Isn't.

Your AI agent has firewalls, prompt injection guards, and monitoring. None of it matters if the host is compromised at the kernel level. A UEFI bootkit survives OS reinstallation. A wiper destroys all data before your SIEM even alerts. BYOVD kills EDR before it can report. Everything above the OS is built on an assumption that was never validated.

Trusted Boot Chain

The boot chain is assumed intact but never validated. Secure Boot can be bypassed. UEFI firmware is writable. The foundation your entire security stack stands on has never been tested.

Invisible Persistence

UEFI firmware is never scanned by EDR. A bootkit can persist through OS reinstallation, disk wipes, and hardware swaps. Your endpoint protection cannot see what lives below it.

Unprotected Recovery

Volume Shadow Copies and backups are assumed available but never tested under adversarial conditions. A wiper deletes VSS, corrupts backups, and overwrites free space before you respond.

EDR Assumptions

Security tools assume they will survive a kernel-level attack. They will not. Bring Your Own Vulnerable Driver loads a signed kernel driver and terminates every security process from ring 0.

The Three Components

PHANTOM KILL operates below the operating system. Three components form a vertical kill chain — suppress security, destroy data, persist in firmware. Each component is independent. Together, they are absolute.

KILLHOOK
WIPER
BOOTKILL

EDR dies. Data dies. The OS can never be reinstalled.

Below the Operating System

Each component targets a layer that no security tool protects. KILLHOOK neutralises defences. WIPER eliminates data. BOOTKILL ensures the compromise survives everything — including reinstallation.

BOOTKILL

T1542.001 • T1542.003

UEFI Persistence Engine. Enumerates firmware interfaces, maps the complete boot chain, identifies UEFI infection vectors, and assesses Secure Boot bypass potential. Tests whether your hardware can be permanently compromised below the OS.

WIPER

T1485 • T1490

Data Destruction Engine. Maps high-value data targets, calculates destruction timelines, identifies Volume Shadow Copy and backup locations, and assesses all recovery vectors. Proves whether your data can be irrecoverably destroyed before you respond.

KILLHOOK

T1562.001 • T1068

Kernel-Mode EDR Suppressor. Enumerates 10 vendor security processes, identifies 8 known BYOVD driver CVEs, maps the optimal kill order, and assesses kernel-level attack surface. Proves whether your EDR survives a ring 0 adversary.

3
Components
7
MITRE Techniques
10
EDR Vendors
8
BYOVD CVEs
571
Tests Passing

Three Phases. Total Compromise.

The Trinity Kill Chain executes in sequence. Phase 1 suppresses all security monitoring. Phase 2 destroys all data and recovery options. Phase 3 establishes permanent firmware persistence. By the time you detect it, there is nothing left to save.

PHASE 1

KILLHOOK

Suppress
PHASE 2

WIPER

Destroy
PHASE 3

BOOTKILL

Persist
PHASE 1

KILLHOOK — Suppress

Load a signed vulnerable driver into the kernel. Enumerate all security vendor processes — CrowdStrike, SentinelOne, Defender, Carbon Black, Sophos, Cylance, ESET, Kaspersky, Trend Micro, Palo Alto. Terminate them from ring 0. EDR cannot defend against an attack from kernel mode. Once KILLHOOK completes, there is no security monitoring on the host.

COMPONENT: KILLHOOK
PHASE 2

WIPER — Destroy

With security suppressed, WIPER identifies all high-value data targets. Deletes Volume Shadow Copies. Corrupts backup catalogues. Overwrites files with cryptographically random data. Destroys MBR/GPT partition tables. Calculates destruction timeline to complete before any out-of-band alert reaches a human operator. Data is irrecoverable.

COMPONENT: WIPER
PHASE 3

BOOTKILL — Persist

With data destroyed and security neutralised, BOOTKILL writes to UEFI firmware. The compromise survives OS reinstallation, disk replacement, and factory reset. The bootkit loads before the OS, before the kernel, before any security tool. The host is permanently owned. The only remediation is hardware replacement.

COMPONENT: BOOTKILL

Assessment vs. Destruction

Standard mode assesses exposure. UNLEASHED mode demonstrates it. Every component shifts from enumeration to execution. Ed25519 key gate required. This is not accidental.

Capability Standard Unleashed
UEFI Enumeration Enumerate firmware interfaces Enumerate + map infection vectors
Boot Chain Mapping Map boot sequence Map + identify Secure Boot bypass
UEFI Infection Assess infection feasibility Write firmware payload
Kernel Persistence Enumerate loaded drivers Load BYOVD driver into kernel
File Destruction Identify high-value targets Overwrite with random data
VSS Deletion Enumerate shadow copies Delete all shadow copies
EDR Termination Enumerate vendor processes Terminate from ring 0
EDR Corruption Assess driver attack surface Corrupt security driver memory
Hardware Brick Assess firmware write capability Corrupt firmware — hardware brick
Report Classification Assessment report CLASSIFIED — destruction evidence
Key Required None Ed25519 + --confirm-destroy

Ed25519 Gate

UNLEASHED mode requires an Ed25519 private key at ~/.redspecter/override_private.pem and the --override --confirm-destroy flags. Without both, PHANTOM KILL operates in assessment-only mode — identifying what could be destroyed, but never executing. The gate is cryptographic. There is no bypass.

Ten Tools. One Kill Chain.

PHANTOM KILL is the foundation layer of the Red Specter offensive pipeline. Every tool above it is irrelevant if the host is compromised below the operating system.

FORGE tests the model.
ARSENAL tests the agent.
PHANTOM tests the swarm.
POLTERGEIST tests the web layer.
GLASS watches the wire.
NEMESIS thinks like the attacker.
SPECTER SOCIAL targets the human.
PHANTOM KILL owns the foundation.
GOLEM attacks the physical layer.
HYDRA attacks the supply chain.
IDRIS discovery & governance.
AI SHIELD defends everything above it.
redspecter-siem SIEM integration.
PHANTOM KILL Position
No AI agent is safe if the host is owned. PHANTOM KILL proves it.

One Command. Below the OS.

PHANTOM KILL is a CLI-first tool. One command runs a full below-OS assessment. Every component reports independently. Every finding is MITRE ATT&CK mapped.

phantom-kill
# Full assessment — all three components
$ phantom-kill assess --all

# KILLHOOK only — enumerate EDR and BYOVD surface
$ phantom-kill assess --component killhook

# WIPER only — map data destruction vectors
$ phantom-kill assess --component wiper

# BOOTKILL only — enumerate UEFI and boot chain
$ phantom-kill assess --component bootkill

# UNLEASHED — dry run (plan destruction, don't execute)
$ phantom-kill assess --all --override

# UNLEASHED — live execution (this is not a drill)
$ phantom-kill assess --all --override --confirm-destroy

# Generate signed report with SIEM export
$ phantom-kill report --session assessment_001 --export-siem splunk

# List components and MITRE mappings
$ phantom-kill components

Signed. Mapped. Exportable.

Every PHANTOM KILL assessment produces evidence-grade output. Every finding is mapped to MITRE ATT&CK. Reports are Ed25519 signed and exportable to enterprise SIEMs.

Ed25519 Signed

Every report cryptographically signed. Tamper-evident. Verify authenticity with a single public key. No modification goes undetected.

MITRE ATT&CK Mapped

Every finding mapped to MITRE ATT&CK techniques. T1542, T1485, T1490, T1562, T1068. Speak the language your threat team already uses.

SIEM Export

One-flag export to Splunk, Microsoft Sentinel, or IBM QRadar. Findings flow directly into your security operations pipeline.

Evidence Chain

Full chain of custody for every finding. Timestamped actions, component attribution, and cryptographic integrity verification throughout.

What Makes It Different

Below the OS

Tests what no other tool reaches. UEFI firmware, boot chain, kernel drivers. The layer everything else stands on.

Pure Engineering

No external binaries. No shellcode downloads. No network calls. Pure Python assessment of below-OS attack surface.

Zero External Tools

No Metasploit. No Cobalt Strike. No third-party dependencies. One pip install. Everything self-contained.

Trinity Kill Chain

Three components, three phases, one outcome. Suppress, destroy, persist. The complete below-OS compromise.

Evidence-Grade

Ed25519 signed. MITRE ATT&CK mapped. SIEM exportable. Not a scan — a forensic assessment of your foundation.

Security Distros & Package Managers

Kali Linux
.deb package
Parrot OS
.deb package
BlackArch
PKGBUILD
REMnux
.deb package
Tsurugi
.deb package
PyPI
pip install

The Adversary That Lives Below the OS.

No AI agent is safe if the host is owned. PHANTOM KILL proves it. Assess your below-OS attack surface before a real adversary does.