I’ve been doing a lot of work lately around creating one-off environments for staging/deconstructing/detonating/generating bills of materials for various flavours of malware, phishing links etc.
I’ve been using a mix of COTS and FOSS software, but it’s been rather rudimentary and not at all using purpose-made components. Lots of scripting, blowing away VMs etc. etc. etc.
Most of the issues some of us run into, however, are that SaaS/Vendor supplied solutions don’t meet the security and compliance of public sector and more security-aware organisations. Just in terms of good practices, should all be tending more towards ownership and digital sovereignty anyway.
Just looking for insight, selfishly for myself, but also for the wider community:
What are you all using and building for this purpose?
If you don’t mind a bit of logrolling, I have done some writing on the topic.
Not all of that is going to apply directly to your needs, but it may be useful to others going down the same road.
Largely, I have found that the highly automated sandboxes such as Cuckoo are either deprecated or…not that automated. So instead, it’s been worth my time to build dedicated virtualization infrastructure for my needs.
I use Proxmox Virtualization Environment (PVE) instead of VMWare or anything else. It’s built on Debian, powerful, and stable. But for updates, my Proxmox cluster has never had a failure in 4 years of operation. I’m able to create virtual switches, hypervisor-level firewalls, and even set up virtual taps for packet capture.
In the Proxmox environment, I use OPNSense to handle DHCP, DNS, NAT, and Firewall rules. I define separate Infrastructure/Lab interfaces, with allowed ingress from infra to the isolation lab, but not the reverse. Could I do a lot of this at the hypervisor level? Yes, but I find using the dedicated router with a “WAN” (my actual LAN) bridge uplink is a lot easier for ongoing maintenance.
I build custom VM templates with Packer and some init scripts—cloud-init for Ubuntu, and Autounattend answer files for Windows—to get my baseline images. I rebuild the Windows templates every few months to stay ahead of eval image expirations. It’s annoying but not the worst. If you have money to may for licenses, I recommend just activating your templates and calling it a day.
Sometimes I’ll just manually spin up a VM to test a sample. But if I need a more interesting buildout—say, a Windows domain—I’ll use Terraform to manage the deployment. With Proxmox provider integrations, this is simple enough.
For a proper malware research lab, this includes at least 3 machines:
Ad-hoc SIEM to collect data (either Splunk or Elastic)
“Victim” machine that will have samples detonated
“Analysis” machine for simultaneous static analysis
The machines need at least 2, maybe 4 cores for baseline sandbox evasion.
Analysis tools (defined later) installed via Chocolatey
Why not use Scoop or Winget to install packages? So far, Choco is the only Windows package manager with every package I need. But I’m revisiting this, since it is a little slow.
On my todo list here is configuration for additional anti-sandbox or evasion techniques, including installing additional language packs and potentially futzing with keyboard drivers.
A particular point of pride: my build uses no on-disk unencrypted secrets of any kind—a claim neither Ludus nor other lab builds can make.
Edited to add: This is not fast the way VT or Tria.ge are. There are ways to automate this further, and we can probably noodle on that together. My objective for this build is deep analysis, so all evidence can be collected from a sample. That’s a different objective than the quick-run sandboxes.
PSA: Yes you can privatize sandboxes, but they are prohibitively expensive Enterprise licenses out of reach for smaller orgs.
In fact it’s such a concern, I will block Virus Total file upload URL, Joe’s, Any.Run, and Hybrid-Analysis auth pages, because I’m worried about defender-adjacenct roles submitting documents to them; all with good intentions, but many people are unaware of the data exposure.
Yep! And in fact an ancillary conversation worth having is sample management inside an org. How do you get the sample from wherever it was discovered into the lab cleanly and safely?
Echoing this as well: A malware research lab machine, where an analyst is getting hands on with debugging and dynamic analysis, is a very different thing than an automated malware analysis sandbox, which is meant to automatically detonate samples and provide behaviour reports, verdicts, and configuration extraction from the sample.