mcpField
A
analyzing-malware-sandbox-evasion-techniques

analyzing-malware-sandbox-evasion-techniques

github.com/mukul975Security35.2k364 installsUpdated 8w ago
Repository

About analyzing-malware-sandbox-evasion-techniques

A security analysis skill for identifying malware sandbox-evasion behavior in Cuckoo Sandbox and AnyRun reports. It extracts behavioral indicators, maps techniques to MITRE ATT&CK T1497, and scores evasion sophistication for deeper review.

Key features

  1. 01解析 Cuckoo 与 AnyRun JSON 报告
  2. 02提取计时相关 API 调用
  3. 03识别虚拟机与环境检测
  4. 04检测睡眠时间膨胀和用户交互检查
  5. 05映射 MITRE ATT&CK T1497 技术

Use cases

  1. 01调查恶意软件沙箱规避行为
  2. 02筛查需深入分析的样本
  3. 03整理规避证据与技术分类

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill analyzing-malware-sandbox-evasion-techniques

After installing, type/analyzing-malware-sandbox-evasion-techniquesin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Analyzing Malware Sandbox Evasion Techniques

Overview

Sandbox evasion (MITRE ATT&CK T1497) allows malware to detect analysis environments and alter behavior to avoid detection. This skill analyzes behavioral reports from Cuckoo Sandbox and AnyRun for evasion indicators including timing-based checks (GetTickCount, QueryPerformanceCounter, sleep inflation), VM artifact detection (registry keys, MAC address prefixes, process names like vmtoolsd.exe), user interaction checks (mouse movement, keyboard input), and environment fingerprinting (disk size, CPU count, RAM). Detection rules flag samples exhibiting these behaviors for deeper manual analysis.

When to Use

  • When investigating security incidents that require analyzing malware sandbox evasion techniques
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Cuckoo Sandbox 2.0+ or AnyRun account for behavioral analysis reports
  • Python 3.8+ with json library for report parsing
  • Behavioral report exports in JSON format

Steps

  1. Parse Cuckoo/AnyRun behavioral report JSON files
  2. Extract API call sequences for timing-related functions
  3. Identify VM artifact detection via registry queries and WMI calls
  4. Detect sleep inflation by comparing requested vs actual sleep durations
  5. Flag user interaction checks (GetCursorPos, GetAsyncKeyState patterns)
  6. Score evasion sophistication based on technique count and diversity
  7. Map detected techniques to MITRE ATT&CK T1497 sub-techniques

Expected Output

JSON report listing detected evasion techniques with MITRE ATT&CK mapping, API call evidence, evasion sophistication score, and classification of evasion categories (timing, VM detection, user interaction, environment fingerprinting).

Comments

Markdown supported