SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
detecting-sandbox-evasion-behavior
0
Detects sandbox and analysis evasion techniques in a sample by scanning static strings, imports, and API traces for VM artifact checks, timing/sleep stalls, anti-debug calls, and environment fingerprinting. Activates for requests to detect sandbox evasion, find anti-VM or anti-debug checks, or explain why a sample did not detonate.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Detecting Sandbox Evasion Behavior ## When to Use - A sample ran inertly in a sandbox and you suspect evasion. - You want to enumerate anti-VM, anti-debug, timing, and environment-fingerprinting checks from static strings/imports and/or an API trace. **Do not use** this to conclude a sample is benign — evasion is itself a malicious signal, and absence of detected checks does not prove there are none. ## Prerequisites - The sample (read inertly) and optionally a JSON API trace. ## Safety & Handling - Read bytes statically; never execute the sample to "see if it evades." ## Workflow ### Step 1: Scan for evasion indicators ```bash python scripts/analyst.py scan sample.bin ``` Searches for VM/sandbox artifact strings (`VMware`, `VBOX`, `vmtoolsd`, `sbiedll`, common sandbox usernames/hostnames), anti-debug APIs (`IsDebuggerPresent`, `CheckRemoteDebuggerPresent`, `NtQueryInformationProcess`), timing stalls (`Sleep`, `GetTickCount`, `rdtsc`), and CPUID checks. ### Step 2: Categorize techniques Group hits into anti-VM, anti-debug, anti-sandbox, and timing/stalling categories. ### Step 3: Recommend bypass and report Suggest analysis adjustments (patch sleeps, hardened VM, hooking) and map findings to ATT&CK. ## Validation - Detected indicators are grouped by evasion category. - Findings distinguish static-string evidence from API-trace evidence when both are provided. - Each category maps to an ATT&CK technique/subtechnique. ## Pitfalls - False positives from benign software that also queries the environment — corroborate. - Strings can be obfuscated; absence of plaintext artifacts is not absence of evasion. - Confusing a hung sample with deliberate stalling without timing evidence. ## References - See [`references/api-reference.md`](references/api-reference.md) for the scanner. - ATT&CK T1497 and T1622 (linked in frontmatter).