reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-skill-repo/skills/malware-analysis/references/sandbox-orchestration.md

@@ -0,0 +1,204 @@
+# 沙箱编排与自动化
+
+## 沙箱选型
+
+| 沙箱 | 类型 | 速度 | 逃逸检测 | 推荐场景 |
+|------|:--:|------|:--:|------|
+| CAPE v2 | 开源 | 中 | 强 | 深度分析 + YARA 集成 |
+| ASD Azul | 开源 | 快 | 中 | 大规模批量分类 |
+| Joe Sandbox | 商业 | 中 | 极强 | 高价值样本深度分析 |
+| ANY.RUN | 商业云 | 快 | 中 | 交互式快速分诊 |
+| Triage | 商业云 | 极快 | 弱 | 批量初筛 |
+| Cuckoo v3 | 开源 | 慢 | 弱 | 学习/研究 |
+
+## CAPE Sandbox 部署
+
+```bash
+# Ubuntu 22.04+
+git clone https://github.com/kevoreilly/CAPEv2
+cd CAPEv2
+sudo ./cape2.sh base    # 安装依赖
+sudo ./cape2.sh all     # 完整安装
+
+# Web 界面: http://localhost:8000
+# API: http://localhost:8000/apiv2/
+
+# 提交样本
+curl -F "file=@sample.exe" http://localhost:8000/apiv2/tasks/create/file/
+
+# 批量提交
+for f in samples/*.exe; do
+    curl -F "file=@$f" http://localhost:8000/apiv2/tasks/create/file/
+done
+```
+
+## 自动化分析管道
+
+```python
+# 多沙箱串联管道
+import requests
+import time
+
+def analyze_sample(filepath):
+    """提交样本到多个沙箱并汇总结果"""
+    results = {}
+
+    # 1. 快速分诊（Triage）
+    triage_result = submit_to_triage(filepath)
+    results['triage'] = triage_result
+
+    # 2. 如果 triage 判定可疑 → 深度分析
+    if triage_result['score'] >= 5:
+        cape_result = submit_to_cape(filepath)
+        results['cape'] = cape_result
+
+        # 3. YARA 规则扫描
+        yara_matches = run_yara(filepath, 'rules/')
+        results['yara'] = yara_matches
+
+        # 4. Sigma 规则生成
+        if cape_result.get('behaviors'):
+            sigma_rules = generate_sigma(cape_result['behaviors'])
+            results['sigma'] = sigma_rules
+
+    # 5. IOC 汇总
+    iocs = extract_iocs(results)
+    results['iocs'] = iocs
+
+    return results
+
+def submit_to_cape(filepath):
+    resp = requests.post(
+        'http://cape:8000/apiv2/tasks/create/file/',
+        files={'file': open(filepath, 'rb')},
+        data={'timeout': 300, 'enforce_timeout': True}
+    )
+    task_id = resp.json()['task_id']
+
+    # 轮询等待完成
+    while True:
+        status = requests.get(
+            f'http://cape:8000/apiv2/tasks/view/{task_id}'
+        ).json()['task']['status']
+        if status == 'reported':
+            break
+        time.sleep(5)
+
+    return requests.get(
+        f'http://cape:8000/apiv2/tasks/report/{task_id}/json/'
+    ).json()
+```
+
+## ASD Azul 集成
+
+```bash
+# Azul — 2026 年 ASD 发布的免费大规模分析平台
+git clone https://github.com/AustralianSignalsDirectorate/azul
+cd azul
+
+# 批量导入样本
+azul import samples/ --tags "phishing_campaign_202605"
+
+# 应用 YARA 规则
+azul scan --yara rules/anti_vm_rules.yar
+
+# Snort 规则检测
+azul scan --snort rules/c2_detection.rules
+
+# 自动提取 IOC
+azul export --format stix2 --output iocs.json
+
+# 自定义插件
+azul plugin add custom_unpacker.py  # 添加自定义解包逻辑
+```
+
+## 反沙箱对抗
+
+### 常见沙箱逃逸技术
+
+```text
+1. 定时延迟
+   → Sleep(120000) // 2分钟，超出沙箱超时
+   → 检测: Hook Sleep → 加速时间
+
+2. 用户交互检测
+   → GetTickCount() 检查鼠标移动
+   → 检测: 模拟用户交互
+
+3. 磁盘大小检测
+   → GetDiskFreeSpaceEx < 60GB
+   → 检测: 扩展虚拟磁盘
+
+4. 特定文件/进程检测
+   → C:\agent\agent.pyw (CAPE)
+   → 检测: 重命名检测组件
+
+5. WMI 虚拟机检测
+   → Win32_ComputerSystem.Manufacturer = "VMware, Inc."
+   → 检测: 修改 SMBIOS
+
+6. MAC 地址检测
+   → 00:0C:29 (VMware OUI), 08:00:27 (VirtualBox)
+   → 检测: 随机 MAC
+```
+
+### CAPE 反逃逸配置
+
+```python
+# CAPE 配置
+[processing]
+# 启用反反分析
+antievasion = yes
+
+# 模拟人机交互
+human_interaction = yes
+
+# 最小运行时间
+timeout = 600
+
+# 检测特定技术
+detect_sleep_skip = yes
+detect_debugger_check = yes
+detect_vm_check = yes
+```
+
+## IOC 自动化提取
+
+```python
+def extract_iocs(analysis_results):
+    iocs = {
+        'network': {'ip': [], 'domain': [], 'url': [], 'user_agent': []},
+        'host': {'files': [], 'registry': [], 'mutex': [], 'services': []},
+        'mitre': [],
+        'hashes': {}
+    }
+
+    # CAPE → IOC 提取
+    if 'cape' in analysis_results:
+        cape = analysis_results['cape']
+        behavior = cape.get('behavior', {})
+
+        # 网络 IOC
+        for conn in behavior.get('network', {}).get('tcp', []):
+            iocs['network']['ip'].append(conn['dst'])
+        for dns in behavior.get('network', {}).get('dns', []):
+            iocs['network']['domain'].append(dns['request'])
+
+        # 文件 IOC
+        for dropped in behavior.get('dropped', []):
+            iocs['host']['files'].append(dropped['path'])
+
+        # Mutex
+        for mutex in behavior.get('summary', {}).get('mutex', []):
+            iocs['host']['mutex'].append(mutex)
+
+    # YARA → MITRE 映射
+    if 'yara' in analysis_results:
+        for match in analysis_results['yara']:
+            if 'mitre_id' in match.get('meta', {}):
+                iocs['mitre'].extend(match['meta']['mitre_id'].split(','))
+
+    return iocs
+```
+
+Source: CAPE v2 docs, ASD Azul documentation, Joe Sandbox v44, Anti-VM YARA Library (2026)