agentsclimarketplace
Sign in

Detecting sandbox evasion behavior

Skill meltedinhex/analyst-ai-pack/skills/detecting-sandbox-evasion-behavior

Detects sandbox and analysis evasion techniques in a sample by scanning static strings, imports, and API traces for VM artifact checks, timing/sleep stalls, anti-debug calls, and environment fingerprinting. Activates for requests to detect sandbox evasion, find anti-VM or anti-debug checks, or explain why a sample did not detonate.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill detecting-sandbox-evasion-behavior

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 431 tokens by cl100k_base, as published. Nobody here has run it

Detecting Sandbox Evasion Behavior

When to Use

  • A sample ran inertly in a sandbox and you suspect evasion.
  • You want to enumerate anti-VM, anti-debug, timing, and environment-fingerprinting checks from static strings/imports and/or an API trace.

Do not use this to conclude a sample is benign — evasion is itself a malicious signal, and absence of detected checks does not prove there are none.

Prerequisites

  • The sample (read inertly) and optionally a JSON API trace.

Safety & Handling

  • Read bytes statically; never execute the sample to "see if it evades."

Workflow

Step 1: Scan for evasion indicators

python scripts/analyst.py scan sample.bin

Searches for VM/sandbox artifact strings (VMware, VBOX, vmtoolsd, sbiedll, common sandbox usernames/hostnames), anti-debug APIs (IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess), timing stalls (Sleep, GetTickCount, rdtsc), and CPUID checks.

Step 2: Categorize techniques

Group hits into anti-VM, anti-debug, anti-sandbox, and timing/stalling categories.

Step 3: Recommend bypass and report

Suggest analysis adjustments (patch sleeps, hardened VM, hooking) and map findings to ATT&CK.

Validation

  • Detected indicators are grouped by evasion category.
  • Findings distinguish static-string evidence from API-trace evidence when both are provided.
  • Each category maps to an ATT&CK technique/subtechnique.

Pitfalls

  • False positives from benign software that also queries the environment — corroborate.
  • Strings can be obfuscated; absence of plaintext artifacts is not absence of evasion.
  • Confusing a hung sample with deliberate stalling without timing evidence.

References

What ships with it: 3 files

3.9 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.