754,000+ skills indexed

AxxxxxxaaannCOMMUNITY

Explore all skills by this author →

Verified:GitHub

analyzing-malware-sandbox-evasion-techniques

Parse Cuckoo/AnyRun reports to detect sandbox evasion signals and map them to MITRE ATT&CK T1497 sub-techniques.

Updated Aug 23, 2026

Search Tags:#behavioral-analysis #mitre-attack #malware-analysis #cuckoo #sandbox-evasion #anyrun #virtualization-detection

One-click install

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-malware-sandbox-evasion-techniques

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: analyzing-malware-sandbox-evasion-techniques
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-malware-sandbox-evasion-techniques
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-malware-sandbox-evasion-techniques

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Detect sandbox evasion signals in malware behavioral reports to classify evasive behavior.

Core Features & Use Cases

Parse Cuckoo/AnyRun reports to extract timing-based, VM artifact, and user interaction indicators.
Map detections to MITRE ATT&CK T1497 sub-techniques for structured threat modeling.
Generate a sortable, machine-readable evasion findings summary for SOC workflows.

Quick Start

Run the agent against a Cuckoo/AnyRun report to generate a structured evasion findings summary.

Frequently Asked Questions about analyzing-malware-sandbox-evasion-techniques

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect sandbox evasion techniques in Cuckoo or AnyRun malware reports?▼

Detect sandbox evasion techniques by parsing Cuckoo or AnyRun JSON reports to extract timing, VM artifact, and user-interaction indicators, mapping them to MITRE ATT&CK T1497 sub-techniques for structured threat modeling.

What are common virtualization detection indicators in malware behavioral analysis?▼

Virtualization detection indicators in malware behavioral analysis include timing-based delays, VM artifact checks, and user-interaction signals parsed from sandbox reports to classify evasive behavior mapped to MITRE ATT&CK T1497.

How do I map malware behavioral analysis findings to MITRE ATT&CK T1497 sub-techniques?▼

Map malware behavioral analysis findings to MITRE ATT&CK T1497 sub-techniques by parsing JSON reports from Cuckoo or AnyRun to identify timing, VM artifact, and user-interaction evasion indicators for structured threat modeling.

Does this sandbox evasion analysis tool work with both Cuckoo and AnyRun JSON reports?▼

Yes, the sandbox evasion analysis tool works with both Cuckoo and AnyRun JSON reports, parsing behavioral data to extract evasion signals and output a structured, machine-readable findings summary for SOC workflows.

Related Skills

Explore More Data & Analytics Skills→

malware-analysis

Dissect malware samples to produce threat intelligence and IOCs.

security-operations

Establish and manage SOC capabilities with SIEM configuration and incident response.

cti-detection-engineer

Generate multi-SIEM detection logic from threat intelligence and MITRE ATT&CK mappings.

a398275770-ctrl

ctf-malware

Analyze malware binaries with static and dynamic analysis tools for CTF challenges.