reverse-skills-max/vendor-new/analyst-ai-pack/skills/detecting-sandbox-evasion-behavior/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
detecting-sandbox-evasion-behavior	Detects sandbox and analysis evasion techniques in a sample by scanning static strings, imports, and API traces for VM artifact checks, timing/sleep stalls, anti-debug calls, and environment fingerprinting. Activates for requests to detect sandbox evasion, find anti-VM or anti-debug checks, or explain why a sample did not detonate.	cybersecurity	malware-analysis	malware-analysis evasion anti-vm anti-debug sandbox	1.0.0	analyst-ai-pack	Apache-2.0	T1497 T1497.001 T1622	D3-DA D3-SDA	MITRE ATT&CK T1497 Virtualization/Sandbox Evasion — https://attack.mitre.org/techniques/T1497/ MITRE ATT&CK T1622 Debugger Evasion — https://attack.mitre.org/techniques/T1622/

Detecting Sandbox Evasion Behavior

When to Use

• A sample ran inertly in a sandbox and you suspect evasion.
• You want to enumerate anti-VM, anti-debug, timing, and environment-fingerprinting checks from static strings/imports and/or an API trace.

Do not use this to conclude a sample is benign — evasion is itself a malicious signal, and absence of detected checks does not prove there are none.

Prerequisites

• The sample (read inertly) and optionally a JSON API trace.

Safety & Handling

• Read bytes statically; never execute the sample to "see if it evades."

Workflow

Step 1: Scan for evasion indicators

python scripts/analyst.py scan sample.bin

Searches for VM/sandbox artifact strings (VMware, VBOX, vmtoolsd, sbiedll, common sandbox usernames/hostnames), anti-debug APIs (IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess), timing stalls (Sleep, GetTickCount, rdtsc), and CPUID checks.

Step 2: Categorize techniques

Group hits into anti-VM, anti-debug, anti-sandbox, and timing/stalling categories.

Step 3: Recommend bypass and report

Suggest analysis adjustments (patch sleeps, hardened VM, hooking) and map findings to ATT&CK.

Validation

• Detected indicators are grouped by evasion category.
• Findings distinguish static-string evidence from API-trace evidence when both are provided.
• Each category maps to an ATT&CK technique/subtechnique.

Pitfalls

• False positives from benign software that also queries the environment — corroborate.
• Strings can be obfuscated; absence of plaintext artifacts is not absence of evasion.
• Confusing a hung sample with deliberate stalling without timing evidence.

References

• See references/api-reference.md for the scanner.
• ATT&CK T1497 and T1622 (linked in frontmatter).