detecting-sandbox-evasion-behavior

Name: detecting-sandbox-evasion-behavior
Author: meltedinhex

18stars5forks

How to install detecting-sandbox-evasion-behavior?

meltedinhex/analyst-ai-pack/detecting-sandbox-evasion-behavior

$npx -y skills add meltedinhex/analyst-ai-pack --skill detecting-sandbox-evasion-behavior

Installs into the current project.

Summary

Detects sandbox and analysis evasion techniques in a sample by scanning static

Files · 1

View on GitHub

SKILL.md

1	# Detecting Sandbox Evasion Behavior
2
3	## When to Use
4
5	- A sample ran inertly in a sandbox and you suspect evasion.
6	- You want to enumerate anti-VM, anti-debug, timing, and environment-fingerprinting checks from
7	static strings/imports and/or an API trace.
8
9	Do not use this to conclude a sample is benign — evasion is itself a malicious signal, and
10	absence of detected checks does not prove there are none.
11
12	## Prerequisites
13
14	- The sample (read inertly) and optionally a JSON API trace.
15
16	## Safety & Handling
17
18	- Read bytes statically; never execute the sample to "see if it evades."
19
20	## Workflow
21
22	### Step 1: Scan for evasion indicators
23
24	```bash
25	python scripts/analyst.py scan sample.bin
26	```
27
28	Searches for VM/sandbox artifact strings (`VMware`, `VBOX`, `vmtoolsd`, `sbiedll`, common
29	sandbox usernames/hostnames), anti-debug APIs (`IsDebuggerPresent`, `CheckRemoteDebuggerPresent`,
30	`NtQueryInformationProcess`), timing stalls (`Sleep`, `GetTickCount`, `rdtsc`), and CPUID checks.
31
32	### Step 2: Categorize techniques
33
34	Group hits into anti-VM, anti-debug, anti-sandbox, and timing/stalling categories.
35
36	### Step 3: Recommend bypass and report
37
38	Suggest analysis adjustments (patch sleeps, hardened VM, hooking) and map findings to ATT&CK.
39
40	## Validation
41
42	- Detected indicators are grouped by evasion category.
43	- Findings distinguish static-string evidence from API-trace evidence when both are provided.
44	- Each category maps to an ATT&CK technique/subtechnique.
45
46	## Pitfalls
47
48	- False positives from benign software that also queries the environment — corroborate.
49	- Strings can be obfuscated; absence of plaintext artifacts is not absence of evasion.
50	- Confusing a hung sample with deliberate stalling without timing evidence.
51
52	## References
53
54	- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
55	- ATT&CK T1497 and T1622 (linked in frontmatter).

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

detecting-sandbox-evasion-behavior

18stars5forks

View on GitHub

How to install detecting-sandbox-evasion-behavior?

meltedinhex/analyst-ai-pack/detecting-sandbox-evasion-behavior

$npx -y skills add meltedinhex/analyst-ai-pack --skill detecting-sandbox-evasion-behavior

Installs into the current project.

Summary

Detects sandbox and analysis evasion techniques in a sample by scanning static

Files · 1

View on GitHub

SKILL.md

1	# Detecting Sandbox Evasion Behavior
2
3	## When to Use
4
5	- A sample ran inertly in a sandbox and you suspect evasion.
6	- You want to enumerate anti-VM, anti-debug, timing, and environment-fingerprinting checks from
7	static strings/imports and/or an API trace.
8
9	Do not use this to conclude a sample is benign — evasion is itself a malicious signal, and
10	absence of detected checks does not prove there are none.
11
12	## Prerequisites
13
14	- The sample (read inertly) and optionally a JSON API trace.
15
16	## Safety & Handling
17
18	- Read bytes statically; never execute the sample to "see if it evades."
19
20	## Workflow
21
22	### Step 1: Scan for evasion indicators
23
24	```bash
25	python scripts/analyst.py scan sample.bin
26	```
27
28	Searches for VM/sandbox artifact strings (`VMware`, `VBOX`, `vmtoolsd`, `sbiedll`, common
29	sandbox usernames/hostnames), anti-debug APIs (`IsDebuggerPresent`, `CheckRemoteDebuggerPresent`,
30	`NtQueryInformationProcess`), timing stalls (`Sleep`, `GetTickCount`, `rdtsc`), and CPUID checks.
31
32	### Step 2: Categorize techniques
33
34	Group hits into anti-VM, anti-debug, anti-sandbox, and timing/stalling categories.
35
36	### Step 3: Recommend bypass and report
37
38	Suggest analysis adjustments (patch sleeps, hardened VM, hooking) and map findings to ATT&CK.
39
40	## Validation
41
42	- Detected indicators are grouped by evasion category.
43	- Findings distinguish static-string evidence from API-trace evidence when both are provided.
44	- Each category maps to an ATT&CK technique/subtechnique.
45
46	## Pitfalls
47
48	- False positives from benign software that also queries the environment — corroborate.
49	- Strings can be obfuscated; absence of plaintext artifacts is not absence of evasion.
50	- Confusing a hung sample with deliberate stalling without timing evidence.
51
52	## References
53
54	- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
55	- ATT&CK T1497 and T1622 (linked in frontmatter).

People who liked this also viewed

6 picks

Type