{"repo":"pandaadir05/ghost","free":true,"listed":false,"github":"https://github.com/pandaadir05/ghost","clone":"git clone https://github.com/pandaadir05/ghost.git","description":"Detects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process hollowing. Built in Rust for speed. Includes CLI and TUI interfaces.","language":"Rust","stars":382,"topics":["cybersecurity","detection","forensics","malware-analysis","memory-analysis","process-injection","reverse-engineering","rust","security","threat-hunting"],"license":"MIT","category":"security-tools","readme_excerpt":"Ghost Ghost is a process injection detection tool written in Rust. It watches running processes and tries to catch suspicious stuff like code injection, memory manipulation, and other tricks that malware uses to hide. What it does The main idea is simple: scan processes and look for weird memory patterns, hooked functions, shellcode, and other signs that something's been tampered with. It works on Windows, Linux, and macOS (though Windows support is the most complete right now). Some of the things it can detect: - Memory regions with read-write-execute permissions - Usually a red flag - Shellcode patterns - Common instruction sequences found in injected code - Process hollowing - When a legit process gets gutted and replaced with malicious code - API hooks - Functions that have been redirected by inline patches or IAT modifications - Thread hijacking - Threads that are redirected to execute shellcode - APC injection - Malicious code queued via Asynchronous Procedure Calls - YARA signatures - Matches against known malware patterns and payloads It also maps detected behaviors to the MITRE ATT&CK framework, which is helpful if you're documenting threats or writing reports. Demo Results stream in as each process is analyzed, with live progress in the title bar ( [scanning N/M] ). Building it You'll need Rust installed (1.70 or newer). Then: On Windows, you'll also need the MSVC build tools. Linux needs basic dev tools (gcc, etc.). macOS needs Xcode command line tools. Running it ","default_branch":null,"files":null,"tree":[],"storefront":"/r/pandaadir05","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/pandaadir05/ghost/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}