Which sandbox report formats are supported?

This skill is specifically designed to parse JSON behavioral reports exported from Cuckoo Sandbox 2.0+ and AnyRun.

What kind of VM artifacts does it look for?

It searches for registry keys, WMI calls, MAC address prefixes, and process names (like vmtoolsd.exe) associated with virtualization environments.

Can it identify 'Sleep' based evasion?

Yes, it identifies sleep inflation by comparing the requested sleep duration against the actual elapsed time recorded in the logs.

Does this skill map findings to MITRE ATT&CK?

Yes, it automatically maps detected evasion techniques to the MITRE ATT&CK T1497 matrix and various NIST frameworks.

Malware Sandbox Evasion Analysis

Name: Malware Sandbox Evasion Analysis
Author: mukul975

bymukul975

•

4,120

•

Security & Testing

Detects and analyzes sophisticated sandbox evasion techniques in malware behavioral reports to identify anti-analysis behavior.

This skill enables security analysts and AI agents to automatically identify complex sandbox evasion techniques (MITRE ATT&CK T1497) by processing behavioral reports from platforms like Cuckoo Sandbox and AnyRun. It parses JSON-formatted logs to pinpoint indicators of timing-based checks, VM artifact detection, sleep inflation, and environmental fingerprinting. By mapping findings to industry-standard frameworks like NIST CSF 2.0 and D3FEND, the skill provides a structured assessment of a sample's sophistication, helping SOC teams prioritize manual analysis for high-risk threats.

Key Features

014,120 GitHub stars

02Analysis of user interaction checks like mouse movement patterns

03Automated mapping to MITRE ATT&CK T1497 sub-techniques

04Automated parsing of Cuckoo and AnyRun JSON behavioral reports

05Identification of VM artifacts including registry keys and MAC addresses

06Detection of timing-based evasion such as GetTickCount and sleep inflation

Use Cases

01Building automated threat hunting queries for evasion indicators

02Triaging suspicious malware samples for advanced anti-analysis logic

03Generating standardized security reports for incident response documentation

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills analyzing-malware-sandbox-evasion-techniques

For use in Claude.ai and ChatGPT

Key Features

014,120 GitHub stars

02Analysis of user interaction checks like mouse movement patterns

03Automated mapping to MITRE ATT&CK T1497 sub-techniques

04Automated parsing of Cuckoo and AnyRun JSON behavioral reports

05Identification of VM artifacts including registry keys and MAC addresses

06Detection of timing-based evasion such as GetTickCount and sleep inflation

Use Cases

01Building automated threat hunting queries for evasion indicators

02Triaging suspicious malware samples for advanced anti-analysis logic

03Generating standardized security reports for incident response documentation

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills analyzing-malware-sandbox-evasion-techniques

For use in Claude.ai and ChatGPT