[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESNP2H09YQ4VG83ZCVJ441":3,"skill-same:01M6ESNP2H09YQ4VG83ZCVJ441":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":14,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":6,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6ESNP2H09YQ4VG83ZCVJ441","analyzing-malware-sandbox-evasion-techniques",null,"Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo\u002FAnyRun behavioral reports","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-malware-sandbox-evasion-techniques\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"malware","analyzing malware sandbox evasion techniques","analyzing","sandbox","evasion","analysis","timing","platform","call","restore","reports","cm","filtering","system","virtualization-detection","anyrun","behavioral-analysis","Cuckoo","vm","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-malware-sandbox-evasion-techniques\ndescription: Detect sandbox evasion techniques in malware samples by analyzing timing\n  checks, VM artifact queries, user interaction detection, and sleep inflation patterns\n  from Cuckoo\u002FAnyRun behavioral reports\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- sandbox-evasion\n- malware-analysis\n- cuckoo\n- anyrun\n- mitre-attack\n- virtualization-detection\n- behavioral-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Platform Hardening\n- Restore Object\n- Process Analysis\n- System Call Filtering\n- Restore Software\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1497.001\n- T1497.003\n- T1480\n- T1027.002\n---\n\n# Analyzing Malware Sandbox Evasion Techniques\n\n## Overview\n\nSandbox evasion (MITRE ATT&CK T1497) allows malware to detect analysis environments and alter behavior to avoid detection. This skill analyzes behavioral reports from Cuckoo Sandbox and AnyRun for evasion indicators including timing-based checks (GetTickCount, QueryPerformanceCounter, sleep inflation), VM artifact detection (registry keys, MAC address prefixes, process names like vmtoolsd.exe), user interaction checks (mouse movement, keyboard input), and environment fingerprinting (disk size, CPU count, RAM). Detection rules flag samples exhibiting these behaviors for deeper manual analysis.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing malware sandbox evasion techniques\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Cuckoo Sandbox 2.0+ or AnyRun account for behavioral analysis reports\n- Python 3.8+ with json library for report parsing\n- Behavioral report exports in JSON format\n\n## Steps\n\n1. Parse Cuckoo\u002FAnyRun behavioral report JSON files\n2. Extract API call sequences for timing-related functions\n3. Identify VM artifact detection via registry queries and WMI calls\n4. Detect sleep inflation by comparing requested vs actual sleep durations\n5. Flag user interaction checks (GetCursorPos, GetAsyncKeyState patterns)\n6. Score evasion sophistication based on technique count and diversity\n7. Map detected techniques to MITRE ATT&CK T1497 sub-techniques\n\n## Expected Output\n\nJSON report listing detected evasion techniques with MITRE ATT&CK mapping, API call evidence, evasion sophistication score, and classification of evasion categories (timing, VM detection, user interaction, environment fingerprinting).\n","# Analyzing Malware Sandbox Evasion Techniques\n\n## Overview\n\nSandbox evasion (MITRE ATT&CK T1497) allows malware to detect analysis environments and alter behavior to avoid detection. This skill analyzes behavioral reports from Cuckoo Sandbox and AnyRun for evasion indicators including timing-based checks (GetTickCount, QueryPerformanceCounter, sleep inflation), VM artifact detection (registry keys, MAC address prefixes, process names like vmtoolsd.exe), user interaction checks (mouse movement, keyboard input), and environment fingerprinting (disk size, CPU count, RAM). Detection rules flag samples exhibiting these behaviors for deeper manual analysis.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing malware sandbox evasion techniques\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Cuckoo Sandbox 2.0+ or AnyRun account for behavioral analysis reports\n- Python 3.8+ with json library for report parsing\n- Behavioral report exports in JSON format\n\n## Steps\n\n1. Parse Cuckoo\u002FAnyRun behavioral report JSON files\n2. Extract API call sequences for timing-related functions\n3. Identify VM artifact detection via registry queries and WMI calls\n4. Detect sleep inflation by comparing requested vs actual sleep durations\n5. Flag user interaction checks (GetCursorPos, GetAsyncKeyState patterns)\n6. Score evasion sophistication based on technique count and diversity\n7. Map detected techniques to MITRE ATT&CK T1497 sub-techniques\n\n## Expected Output\n\nJSON report listing detected evasion techniques with MITRE ATT&CK mapping, API call evidence, evasion sophistication score, and classification of evasion categories (timing, VM detection, user interaction, environment fingerprinting).\n",{"name":5,"tags":44,"author":49,"domain":38,"license":15,"version":50,"nist_csf":51,"subdomain":46,"description":7,"mitre_attack":56,"d3fend_techniques":61},[45,46,47,34,48,33,35],"sandbox-evasion","malware-analysis","cuckoo","mitre-attack","mahipal","1.0",[52,53,54,55],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01",[57,58,59,60],"T1497.001","T1497.003","T1480","T1027.002",[62,63,64,65,66],"Platform Hardening","Restore Object","Process Analysis","System Call Filtering","Restore Software","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-malware-sandbox-evasion-techniques","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-malware-sandbox-evasion-techniques",{"tool":81,"command":82},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-malware-sandbox-evasion-techniques",{"tool":84,"command":85},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-malware-sandbox-evasion-techniques","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-malware-sandbox-evasion-techniques\u002FSKILL.md",true,[89,94,100],{"path":90,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-malware-sandbox-evasion-techniques\u002FLICENSE",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fapi-reference.md","REFERENCE","参考文档",2066,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-malware-sandbox-evasion-techniques\u002Freferences\u002Fapi-reference.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",8137,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-malware-sandbox-evasion-techniques\u002Fscripts\u002Fagent.py",[107,150,159,168,190,217],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":130,"publishedAt":39},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[114,119,122,125],{"categoryNo":115,"categoryName":116,"taxonomyType":117,"taxonomyTypeDesc":118},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",{"categoryNo":120,"categoryName":121,"taxonomyType":117,"taxonomyTypeDesc":118},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":123,"categoryName":124,"taxonomyType":117,"taxonomyTypeDesc":118},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":126,"categoryName":127,"taxonomyType":128,"taxonomyTypeDesc":129},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[109,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":151,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":158,"publishedAt":39},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[154,155,156,157],{"categoryNo":115,"categoryName":116,"taxonomyType":117,"taxonomyTypeDesc":118},{"categoryNo":120,"categoryName":121,"taxonomyType":117,"taxonomyTypeDesc":118},{"categoryNo":123,"categoryName":124,"taxonomyType":117,"taxonomyTypeDesc":118},{"categoryNo":126,"categoryName":127,"taxonomyType":128,"taxonomyTypeDesc":129},[109,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149],{"skillNo":160,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":167,"publishedAt":39},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[163,164,165,166],{"categoryNo":115,"categoryName":116,"taxonomyType":117,"taxonomyTypeDesc":118},{"categoryNo":120,"categoryName":121,"taxonomyType":117,"taxonomyTypeDesc":118},{"categoryNo":123,"categoryName":124,"taxonomyType":117,"taxonomyTypeDesc":118},{"categoryNo":126,"categoryName":127,"taxonomyType":128,"taxonomyTypeDesc":129},[109,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149],{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":174,"publishedAt":39},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[175,176,177,178,179,180,181,182,183,184,185,186,187,188,189],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":199,"publishedAt":39},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[196],{"categoryNo":197,"categoryName":198,"taxonomyType":117,"taxonomyTypeDesc":118},"01JBSEEDCAT000000000000023","Skill与智能体开发",[200,201,202,203,204,205,24,206,207,208,209,142,143,210,211,212,213,214,215,216],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":233,"publishedAt":39},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[223,226,229,230],{"categoryNo":224,"categoryName":225,"taxonomyType":117,"taxonomyTypeDesc":118},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":227,"categoryName":228,"taxonomyType":117,"taxonomyTypeDesc":118},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":197,"categoryName":198,"taxonomyType":117,"taxonomyTypeDesc":118},{"categoryNo":231,"categoryName":232,"taxonomyType":128,"taxonomyTypeDesc":129},"01JBSEEDCAT000000000000036","内容创作者",[234,235,236,237,238,239,240,241,139,242,142,143,144,243,244,245,246,247,189,248],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]