Skill

analyzing-malware-sandbox-evasion-techniques

From asi

Detects sandbox evasion techniques in malware from Cuckoo/AnyRun behavioral reports by analyzing timing checks, VM artifacts, user interaction detection, and sleep inflation patterns. Maps to MITRE ATT&CK T1497 for security analysts.

Python

security

npx claudepluginhub plurigrid/asi --plugin asi

Tool Access

This skill uses the workspace's default tool permissions.

Preview

SKILL.md

Similar Skills

analyzing-malware-sandbox-evasion-techniques

5.9k

Detects sandbox evasion techniques in malware from Cuckoo/AnyRun behavioral reports by analyzing timing checks, VM artifacts, user interactions, and sleep inflation.

3 files

cybersecurity-skills

analyzing-malware-sandbox-evasion-techniques

Analyzes Cuckoo/AnyRun behavior reports to detect malware sandbox evasion techniques like timing checks, VM artifacts, user interaction detection, and sleep inflation.

3 files

cybersecurity-skills-zh

analyzing-malware-behavior-with-cuckoo-sandbox

Executes malware samples in Cuckoo Sandbox to observe runtime behavior like process creation, file changes, registry mods, network activity, and API calls. Generates reports for classification and IOC extraction.

asi

Stats

Parent Repo Stars16

Parent Repo Forks5

Last CommitApr 4, 2026

Actions

View Source View Plugin View on GitHub View README

Help us improve

Share bugs, ideas, or general feedback.

Analyzing Malware Sandbox Evasion Techniques

Overview

Sandbox evasion (MITRE ATT&CK T1497) allows malware to detect analysis environments and alter behavior to avoid detection. This skill analyzes behavioral reports from Cuckoo Sandbox and AnyRun for evasion indicators including timing-based checks (GetTickCount, QueryPerformanceCounter, sleep inflation), VM artifact detection (registry keys, MAC address prefixes, process names like vmtoolsd.exe), user interaction checks (mouse movement, keyboard input), and environment fingerprinting (disk size, CPU count, RAM). Detection rules flag samples exhibiting these behaviors for deeper manual analysis.

When to Use

When investigating security incidents that require analyzing malware sandbox evasion techniques

When building detection rules or threat hunting queries for this domain

When SOC analysts need structured procedures for this analysis type

When validating security monitoring coverage for related attack techniques

Prerequisites

Cuckoo Sandbox 2.0+ or AnyRun account for behavioral analysis reports

Python 3.8+ with json library for report parsing

Behavioral report exports in JSON format

Steps

Parse Cuckoo/AnyRun behavioral report JSON files

Extract API call sequences for timing-related functions

Identify VM artifact detection via registry queries and WMI calls

Detect sleep inflation by comparing requested vs actual sleep durations

Flag user interaction checks (GetCursorPos, GetAsyncKeyState patterns)

Score evasion sophistication based on technique count and diversity

Map detected techniques to MITRE ATT&CK T1497 sub-techniques

Expected Output

JSON report listing detected evasion techniques with MITRE ATT&CK mapping, API call evidence, evasion sophistication score, and classification of evasion categories (timing, VM detection, user interaction, environment fingerprinting).