205 lines
5.1 KiB
Markdown
205 lines
5.1 KiB
Markdown
# 沙箱编排与自动化
|
||
|
||
## 沙箱选型
|
||
|
||
| 沙箱 | 类型 | 速度 | 逃逸检测 | 推荐场景 |
|
||
|------|:--:|------|:--:|------|
|
||
| CAPE v2 | 开源 | 中 | 强 | 深度分析 + YARA 集成 |
|
||
| ASD Azul | 开源 | 快 | 中 | 大规模批量分类 |
|
||
| Joe Sandbox | 商业 | 中 | 极强 | 高价值样本深度分析 |
|
||
| ANY.RUN | 商业云 | 快 | 中 | 交互式快速分诊 |
|
||
| Triage | 商业云 | 极快 | 弱 | 批量初筛 |
|
||
| Cuckoo v3 | 开源 | 慢 | 弱 | 学习/研究 |
|
||
|
||
## CAPE Sandbox 部署
|
||
|
||
```bash
|
||
# Ubuntu 22.04+
|
||
git clone https://github.com/kevoreilly/CAPEv2
|
||
cd CAPEv2
|
||
sudo ./cape2.sh base # 安装依赖
|
||
sudo ./cape2.sh all # 完整安装
|
||
|
||
# Web 界面: http://localhost:8000
|
||
# API: http://localhost:8000/apiv2/
|
||
|
||
# 提交样本
|
||
curl -F "file=@sample.exe" http://localhost:8000/apiv2/tasks/create/file/
|
||
|
||
# 批量提交
|
||
for f in samples/*.exe; do
|
||
curl -F "file=@$f" http://localhost:8000/apiv2/tasks/create/file/
|
||
done
|
||
```
|
||
|
||
## 自动化分析管道
|
||
|
||
```python
|
||
# 多沙箱串联管道
|
||
import requests
|
||
import time
|
||
|
||
def analyze_sample(filepath):
|
||
"""提交样本到多个沙箱并汇总结果"""
|
||
results = {}
|
||
|
||
# 1. 快速分诊（Triage）
|
||
triage_result = submit_to_triage(filepath)
|
||
results['triage'] = triage_result
|
||
|
||
# 2. 如果 triage 判定可疑 → 深度分析
|
||
if triage_result['score'] >= 5:
|
||
cape_result = submit_to_cape(filepath)
|
||
results['cape'] = cape_result
|
||
|
||
# 3. YARA 规则扫描
|
||
yara_matches = run_yara(filepath, 'rules/')
|
||
results['yara'] = yara_matches
|
||
|
||
# 4. Sigma 规则生成
|
||
if cape_result.get('behaviors'):
|
||
sigma_rules = generate_sigma(cape_result['behaviors'])
|
||
results['sigma'] = sigma_rules
|
||
|
||
# 5. IOC 汇总
|
||
iocs = extract_iocs(results)
|
||
results['iocs'] = iocs
|
||
|
||
return results
|
||
|
||
def submit_to_cape(filepath):
|
||
resp = requests.post(
|
||
'http://cape:8000/apiv2/tasks/create/file/',
|
||
files={'file': open(filepath, 'rb')},
|
||
data={'timeout': 300, 'enforce_timeout': True}
|
||
)
|
||
task_id = resp.json()['task_id']
|
||
|
||
# 轮询等待完成
|
||
while True:
|
||
status = requests.get(
|
||
f'http://cape:8000/apiv2/tasks/view/{task_id}'
|
||
).json()['task']['status']
|
||
if status == 'reported':
|
||
break
|
||
time.sleep(5)
|
||
|
||
return requests.get(
|
||
f'http://cape:8000/apiv2/tasks/report/{task_id}/json/'
|
||
).json()
|
||
```
|
||
|
||
## ASD Azul 集成
|
||
|
||
```bash
|
||
# Azul — 2026 年 ASD 发布的免费大规模分析平台
|
||
git clone https://github.com/AustralianSignalsDirectorate/azul
|
||
cd azul
|
||
|
||
# 批量导入样本
|
||
azul import samples/ --tags "phishing_campaign_202605"
|
||
|
||
# 应用 YARA 规则
|
||
azul scan --yara rules/anti_vm_rules.yar
|
||
|
||
# Snort 规则检测
|
||
azul scan --snort rules/c2_detection.rules
|
||
|
||
# 自动提取 IOC
|
||
azul export --format stix2 --output iocs.json
|
||
|
||
# 自定义插件
|
||
azul plugin add custom_unpacker.py # 添加自定义解包逻辑
|
||
```
|
||
|
||
## 反沙箱对抗
|
||
|
||
### 常见沙箱逃逸技术
|
||
|
||
```text
|
||
1. 定时延迟
|
||
→ Sleep(120000) // 2分钟，超出沙箱超时
|
||
→ 检测: Hook Sleep → 加速时间
|
||
|
||
2. 用户交互检测
|
||
→ GetTickCount() 检查鼠标移动
|
||
→ 检测: 模拟用户交互
|
||
|
||
3. 磁盘大小检测
|
||
→ GetDiskFreeSpaceEx < 60GB
|
||
→ 检测: 扩展虚拟磁盘
|
||
|
||
4. 特定文件/进程检测
|
||
→ C:\agent\agent.pyw (CAPE)
|
||
→ 检测: 重命名检测组件
|
||
|
||
5. WMI 虚拟机检测
|
||
→ Win32_ComputerSystem.Manufacturer = "VMware, Inc."
|
||
→ 检测: 修改 SMBIOS
|
||
|
||
6. MAC 地址检测
|
||
→ 00:0C:29 (VMware OUI), 08:00:27 (VirtualBox)
|
||
→ 检测: 随机 MAC
|
||
```
|
||
|
||
### CAPE 反逃逸配置
|
||
|
||
```python
|
||
# CAPE 配置
|
||
[processing]
|
||
# 启用反反分析
|
||
antievasion = yes
|
||
|
||
# 模拟人机交互
|
||
human_interaction = yes
|
||
|
||
# 最小运行时间
|
||
timeout = 600
|
||
|
||
# 检测特定技术
|
||
detect_sleep_skip = yes
|
||
detect_debugger_check = yes
|
||
detect_vm_check = yes
|
||
```
|
||
|
||
## IOC 自动化提取
|
||
|
||
```python
|
||
def extract_iocs(analysis_results):
|
||
iocs = {
|
||
'network': {'ip': [], 'domain': [], 'url': [], 'user_agent': []},
|
||
'host': {'files': [], 'registry': [], 'mutex': [], 'services': []},
|
||
'mitre': [],
|
||
'hashes': {}
|
||
}
|
||
|
||
# CAPE → IOC 提取
|
||
if 'cape' in analysis_results:
|
||
cape = analysis_results['cape']
|
||
behavior = cape.get('behavior', {})
|
||
|
||
# 网络 IOC
|
||
for conn in behavior.get('network', {}).get('tcp', []):
|
||
iocs['network']['ip'].append(conn['dst'])
|
||
for dns in behavior.get('network', {}).get('dns', []):
|
||
iocs['network']['domain'].append(dns['request'])
|
||
|
||
# 文件 IOC
|
||
for dropped in behavior.get('dropped', []):
|
||
iocs['host']['files'].append(dropped['path'])
|
||
|
||
# Mutex
|
||
for mutex in behavior.get('summary', {}).get('mutex', []):
|
||
iocs['host']['mutex'].append(mutex)
|
||
|
||
# YARA → MITRE 映射
|
||
if 'yara' in analysis_results:
|
||
for match in analysis_results['yara']:
|
||
if 'mitre_id' in match.get('meta', {}):
|
||
iocs['mitre'].extend(match['meta']['mitre_id'].split(','))
|
||
|
||
return iocs
|
||
```
|
||
|
||
Source: CAPE v2 docs, ASD Azul documentation, Joe Sandbox v44, Anti-VM YARA Library (2026)
|