reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/detecting-sandbox-evasion-behavior/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/detecting-sandbox-evasion-behavior/SKILL.md

@@ -0,0 +1,84 @@
+---
+name: detecting-sandbox-evasion-behavior
+description: 'Detects sandbox and analysis evasion techniques in a sample by scanning static
+  strings, imports, and API traces for VM artifact checks, timing/sleep stalls, anti-debug calls,
+  and environment fingerprinting. Activates for requests to detect sandbox evasion, find anti-VM
+  or anti-debug checks, or explain why a sample did not detonate.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - evasion
+  - anti-vm
+  - anti-debug
+  - sandbox
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1497
+  - T1497.001
+  - T1622
+d3fend:
+  - D3-DA
+  - D3-SDA
+references:
+  - 'MITRE ATT&CK T1497 Virtualization/Sandbox Evasion — https://attack.mitre.org/techniques/T1497/'
+  - 'MITRE ATT&CK T1622 Debugger Evasion — https://attack.mitre.org/techniques/T1622/'
+---
+
+# Detecting Sandbox Evasion Behavior
+
+## When to Use
+
+- A sample ran inertly in a sandbox and you suspect evasion.
+- You want to enumerate anti-VM, anti-debug, timing, and environment-fingerprinting checks from
+  static strings/imports and/or an API trace.
+
+**Do not use** this to conclude a sample is benign — evasion is itself a malicious signal, and
+absence of detected checks does not prove there are none.
+
+## Prerequisites
+
+- The sample (read inertly) and optionally a JSON API trace.
+
+## Safety & Handling
+
+- Read bytes statically; never execute the sample to "see if it evades."
+
+## Workflow
+
+### Step 1: Scan for evasion indicators
+
+```bash
+python scripts/analyst.py scan sample.bin
+```
+
+Searches for VM/sandbox artifact strings (`VMware`, `VBOX`, `vmtoolsd`, `sbiedll`, common
+sandbox usernames/hostnames), anti-debug APIs (`IsDebuggerPresent`, `CheckRemoteDebuggerPresent`,
+`NtQueryInformationProcess`), timing stalls (`Sleep`, `GetTickCount`, `rdtsc`), and CPUID checks.
+
+### Step 2: Categorize techniques
+
+Group hits into anti-VM, anti-debug, anti-sandbox, and timing/stalling categories.
+
+### Step 3: Recommend bypass and report
+
+Suggest analysis adjustments (patch sleeps, hardened VM, hooking) and map findings to ATT&CK.
+
+## Validation
+
+- Detected indicators are grouped by evasion category.
+- Findings distinguish static-string evidence from API-trace evidence when both are provided.
+- Each category maps to an ATT&CK technique/subtechnique.
+
+## Pitfalls
+
+- False positives from benign software that also queries the environment — corroborate.
+- Strings can be obfuscated; absence of plaintext artifacts is not absence of evasion.
+- Confusing a hung sample with deliberate stalling without timing evidence.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
+- ATT&CK T1497 and T1622 (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/detecting-sandbox-evasion-behavior/references/api-reference.md

@@ -0,0 +1,38 @@
+# API Reference: Detecting Sandbox Evasion Behavior
+
+## Overview
+
+`scripts/analyst.py` extracts ASCII and UTF-16LE strings from a sample and matches them against
+curated evasion artifact lists (anti-VM, anti-sandbox, anti-debug, timing, fingerprinting),
+returning hits grouped by category. It reads bytes statically and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | regex, JSON, file IO |
+
+## Core functions
+
+### `scan(path)`
+Returns categories found, per-category indicator hits, and an `evasion_suspected` boolean.
+
+## Indicator categories
+
+- **anti_vm**: VMware/VirtualBox/QEMU/Xen artifacts and guest tool names.
+- **anti_sandbox**: Sandboxie, Cuckoo, analysis tools, telltale sample names/usernames.
+- **anti_debug**: `IsDebuggerPresent`, `NtQueryInformationProcess`, etc.
+- **timing**: `GetTickCount`, `rdtsc`, `Sleep` stalls.
+- **fingerprint**: username/hostname/RAM/disk/CPUID environment checks.
+
+## Usage
+
+```bash
+python scripts/analyst.py scan sample.bin
+```
+
+## Sources
+
+- MITRE ATT&CK T1497 Virtualization/Sandbox Evasion — https://attack.mitre.org/techniques/T1497/
+- MITRE ATT&CK T1622 Debugger Evasion — https://attack.mitre.org/techniques/T1622/
+- Common VM/sandbox guest artifacts documented across public anti-analysis research

vendor-new/analyst-ai-pack/skills/detecting-sandbox-evasion-behavior/scripts/analyst.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+"""Scan a sample's printable strings for sandbox/VM/anti-debug evasion indicators.
+
+Extracts ASCII/UTF-16LE strings and matches them against curated evasion artifact lists. Reports
+hits grouped by category. Reads bytes statically; executes nothing.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+
+ASCII_RE = re.compile(rb"[\x20-\x7e]{4,}")
+UTF16_RE = re.compile(rb"(?:[\x20-\x7e]\x00){4,}")
+
+INDICATORS = {
+    "anti_vm": ["vmware", "vbox", "virtualbox", "vmtoolsd", "vboxservice", "qemu", "xen",
+                "red hat virtio", "vmci", "prl_", "hyperv", "innotek"],
+    "anti_sandbox": ["sbiedll", "sandboxie", "cuckoo", "wireshark", "procmon", "vmsrvc",
+                     "sample.exe", "malware", "maltest", "john doe"],
+    "anti_debug": ["isdebuggerpresent", "checkremotedebuggerpresent",
+                   "ntqueryinformationprocess", "outputdebugstring", "ntsetinformationthread",
+                   "dbghelp", "blockinput"],
+    "timing": ["gettickcount", "queryperformancecounter", "rdtsc",
+               "timegettime", "sleep"],
+    "fingerprint": ["getusername", "getcomputername", "getsystemmetrics", "globalmemorystatus",
+                    "getdiskfreespace", "cpuid", "getadaptersinfo"],
+}
+
+
+def _strings(data: bytes) -> set[str]:
+    out = {m.decode("ascii", "ignore").lower() for m in ASCII_RE.findall(data)}
+    out |= {m.decode("utf-16-le", "ignore").lower() for m in UTF16_RE.findall(data)}
+    return out
+
+
+def scan(path: str) -> dict:
+    blob = " ".join(_strings(Path(path).read_bytes()))
+    results = {}
+    for cat, needles in INDICATORS.items():
+        hits = sorted({n for n in needles if n in blob})
+        if hits:
+            results[cat] = hits
+    return {
+        "categories_found": sorted(results.keys()),
+        "indicators": results,
+        "evasion_suspected": bool(results),
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Scan for sandbox/anti-debug evasion indicators")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("scan")
+    p.add_argument("file")
+    args = parser.parse_args(argv)
+    print(json.dumps(scan(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())