LitterBox
starsforks
How to install LitterBox?
blacksnufkin/litterbox
$git clone https://github.com/BlackSnufkin/LitterBoxA self-hosted payload-analysis sandbox for red teams. Upload a sample, run static / dynamic / EDR analysis against it, get a Detection Score and a triggering-indicators breakdown — decide whether the payload is field-ready before it leaves the lab.
README.md
| 1 | # LitterBox |
| 2 | |
| 3 |  |
| 4 | |
| 5 | []() |
| 6 | []() |
| 7 | []() |
| 8 | []() |
| 9 | []() |
| 10 | [](https://deepwiki.com/BlackSnufkin/LitterBox) |
| 11 | [](https://github.com/BlackSnufkin/LitterBox/stargazers) |
| 12 | |
| 13 | A self-hosted payload-analysis sandbox for red teams. Upload a sample, run static / dynamic / EDR analysis against it, get a Detection Score and a triggering-indicators breakdown — decide whether the payload is field-ready before it leaves the lab. |
| 14 | |
| 15 | LitterBox can also dispatch payloads to a separate EDR-instrumented Windows VM (Elastic Defend or Fibratus) and pull the correlated detection alerts back into the results page. |
| 16 | |
| 17 | > While designed primarily for red teams, LitterBox is equally useful for blue teams running the same tools in their malware-analysis workflows. |
| 18 | |
| 19 | ## Documentation |
| 20 | |
| 21 | Operator and developer documentation lives in the **[LitterBox Wiki](../../wiki)**. |
| 22 | |
| 23 | | Topic | Wiki page | |
| 24 | |---|---| |
| 25 | | How everything fits together | [Application Architecture](../../wiki/Application-Architecture) | |
| 26 | | Run static + every reachable EDR in parallel | [All in One Pipeline](../../wiki/All-in-One-Pipeline) | |
| 27 | | Dispatch payloads to a real EDR VM | [EDR Integration](../../wiki/EDR-Integration) → [Elastic Defend](../../wiki/Elastic-Defend-Setup) / [Fibratus](../../wiki/Fibratus-Setup) | |
| 28 | | Whiskers agent (install, endpoints, build) | [Whiskers Agent](../../wiki/Whiskers-Agent) | |
| 29 | | Every HTTP endpoint | [HTTP API Reference](../../wiki/HTTP-API-Reference) | |
| 30 | | CLI / Python lib / MCP for LLMs | [GrumpyCats CLI](../../wiki/GrumpyCats-CLI) · [GrumpyCats Library](../../wiki/GrumpyCats-Library) · [LitterBoxMCP](../../wiki/LitterBoxMCP) | |
| 31 | | What feeds the Detection Score | [Detection Score Explained](../../wiki/Detection-Score-Explained) | |
| 32 | | Configure scanners / paths / timeouts | [Configuration Reference](../../wiki/Configuration-Reference) | |
| 33 | | Add custom YARA rules / scanners | [YARA Rules Management](../../wiki/YARA-Rules-Management) · [New Scanner](../../wiki/New-Scanner) | |
| 34 | |
| 35 | ## Installation |
| 36 | |
| 37 | ### Windows |
| 38 | |
| 39 | ```bash |
| 40 | git clone https://github.com/BlackSnufkin/LitterBox.git |
| 41 | cd LitterBox |
| 42 | python -m venv venv |
| 43 | .\venv\Scripts\Activate.ps1 |
| 44 | pip install -r requirements.txt |
| 45 | python litterbox.py # add --debug for verbose logging |
| 46 | ``` |
| 47 | |
| 48 | Open `http://127.0.0.1:1337`. Requires Python 3.11+ and an admin shell. |
| 49 | |
| 50 | ### Linux (Docker) |
| 51 | |
| 52 | ```bash |
| 53 | git clone https://github.com/BlackSnufkin/LitterBox.git |
| 54 | cd LitterBox/Docker |
| 55 | chmod +x setup.sh |
| 56 | ./setup.sh |
| 57 | ``` |
| 58 | |
| 59 | The setup script provisions a Windows 10 container with KVM and runs LitterBox inside. Initial build takes ~1 hour. |
| 60 | |
| 61 | - **Install monitor**: `http://localhost:8006` |
| 62 | - **RDP**: `localhost:3389` (creds in the docker compose file) |
| 63 | - **LitterBox UI**: `http://127.0.0.1:1337` once setup completes |
| 64 | |
| 65 | ### EDR setup (optional) |
| 66 | |
| 67 | Drop one or more profile YAMLs under `Config/edr_profiles/` and the upload page picks them up at boot. Full walkthroughs in the wiki: [Whiskers Agent](../../wiki/Whiskers-Agent) → [Elastic Defend Setup](../../wiki/Elastic-Defend-Setup) or [Fibratus Setup](../../wiki/Fibratus-Setup). |
| 68 | |
| 69 | ## Scanners |
| 70 | |
| 71 | Bundled binaries under `Scanners/`. Versions and last-update dates tracked here so operators can tell at a glance whether a scanner is current. |
| 72 | |
| 73 | | Scanner | Version | Last updated | Source | |
| 74 | |---|---|---|---| |
| 75 | | [PE-Sieve](https://github.com/hasherezade/pe-sieve) | 0.4.1.2 (`f1dc39d`) | 2026-05-02 | hashe |
People who liked this also viewed
6 picksType
- mcp-scannerScan MCP servers for potential threats & security findings.MCP ServersJul 2026
- hol-guardOpen-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.MCP ServersJul 2026
- agent-scanSecurity scanner for AI agents, MCP servers and agent skills.MCP ServersJul 2026
- falcon-mcpConnect AI agents to CrowdStrike Falcon for automated security analysis and threat huntingMCP ServersJul 2026
- python🔐 Plug-and-play auth for Python MCP servers.MCP ServersAug 2025
- auth0-mcp-serverConnect LLMs and AI agents to Auth0 Management APIs via an MCP server. Use natural-language commands to create apps, deploy Actions, and query logs—runs locally and supports interactive tenant authentication for secure Auth0 administration from AI tools/CLIs.MCP ServersJul 2026
