Guide · Agent skill
How to use the Malware Sandbox Evasion Analyzer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This is an agent skill that teaches an AI agent to review behavioral reports from malware sandboxes, Cuckoo Sandbox or AnyRun, and look for signs that a sample is detecting the analysis environment and hiding its real behavior. It is aimed at malware analysts, detection engineers and students who have a sample that showed little or no activity in a sandbox. After this guide you will be able to install the skill, ask an agent to run it on exported report files, and understand what the output does and does not tell you.
Malware Sandbox Evasion Analyzermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it to get the analyzing-malware-sandbox-evasion-techniques folder.
- 2Place the folder. Move the folder into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder.
- 3Or upload it in the apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 4Confirm Python 3.8+. Make sure Python 3.8 or newer is available, since scripts/agent.py depends on it.
- 5Export a report. Export the behavioral report JSON from Cuckoo Sandbox 2.0+ or AnyRun for the sample.
- 6Ask in plain language. Describe the sample and point the agent at the exported file, asking it to check for sandbox evasion.
- 7Review the JSON output. Read the evidence, ATT&CK mapping and sophistication score, then verify the flagged indicators manually.
What an agent skill is and what this one makes the agent do
An agent skill is a folder containing a SKILL.md file with instructions, plus optional reference files and scripts that an AI agent can load when a request matches the skill's description. This one is for analyzing sandbox evasion in malware behavioral reports.
The skill checks reports for timing-based checks (such as GetTickCount, QueryPerformanceCounter and sleep inflation), VM artifact queries (registry keys, MAC address prefixes, process names like vmtoolsd.exe), user-interaction checks (mouse movement and keyboard input), and environment fingerprinting (disk size, CPU count, RAM). It maps findings to MITRE ATT&CK T1497 sub-techniques and produces a JSON report with a sophistication score and evidence, for a human analyst to review.
- T1497.001 System Checks: VM artifacts, registry keys, MAC prefixes, process names
- T1497.002 User Activity Based Checks: mouse movement, keyboard input, foreground window
- T1497.003 Time Based Evasion: GetTickCount, sleep inflation, RDTSC timing
Install the skill from the ZIP or the Claude apps
Download the ZIP for this skill from this page and unzip it. For a personal install, place the skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.
If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/analyzing-malware-sandbox-evasion-techniques/
- Project: .claude/skills/analyzing-malware-sandbox-evasion-techniques/
- Claude apps: Settings → Capabilities → Skills
Check the requirements before you start
You need Python 3.8 or newer, and one of these inputs: a Cuckoo Sandbox 2.0+ instance, an AnyRun account, or behavioral report files already exported as JSON. The skill works on exported report files and does not inspect your machines directly.
The skill runs scripts (scripts/agent.py) and does not use the network.
- Python 3.8+
- Cuckoo Sandbox 2.0+ or AnyRun account, or exported behavioral report JSON files
- Runs scripts: yes. Uses network: no
Trigger the skill with natural requests
You do not call the skill by name. Describe the situation and the agent will load it when the request matches the skill's description. The description mentions cases such as a sample showing no or minimal activity in a sandbox, a behavioral report that needs review for evasion indicators, or building detections for anti-analysis techniques.
Point the agent at the exported report file so it knows what to parse.
- "This sample showed almost no activity in Cuckoo. Check the exported report at reports/sample1.json for sandbox evasion."
- "Review this AnyRun JSON export for VM artifact checks and sleep inflation."
- "Map the timing and user-interaction checks in this report to MITRE ATT&CK T1497 sub-techniques."
Read the output with the right expectations
The output is a JSON report listing detected evasion techniques, MITRE ATT&CK mapping, API call evidence, an evasion sophistication score, and categories (timing, VM detection, user interaction, environment fingerprinting).
Treat the output as a list of indicators for deeper manual review. The API names and artifact lists are heuristic and can produce false positives on legitimate software. The skill does not give a final verdict on whether a file is malicious.
Tips for better results
Give the agent a complete export, not a summary, so the API call sequences are present. Compare the flagged evidence against the sample's behavior in your own lab before drawing conclusions.
Use the references/api-reference.md file as the lookup for the timing API indicators and the Cuckoo report structure.
- Export the full behavioral JSON from Cuckoo or AnyRun
- Keep the output as evidence for analyst review, not as a verdict
- Do not run this against live production machines; it works on report files
What people use it for
- Explaining why a sample did nothing in Cuckoo by finding timing checks and long sleeps
- Spotting VM artifact queries such as VMware or VirtualBox registry keys and process names in an AnyRun export
- Flagging mouse or keyboard polling that suggests the malware waits for a human
- Mapping findings to MITRE ATT&CK T1497 sub-techniques for a report
- Teaching students how sandbox evasion appears in API call traces
Frequently asked questions
How do I install the analyzing-malware-sandbox-evasion-techniques skill?
Download the ZIP from this page and unzip it. Place the folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder. In the Claude apps you can upload it under Settings → Capabilities → Skills.
What do I need to run this skill?
Python 3.8 or newer, plus either a Cuckoo Sandbox 2.0+ instance, an AnyRun account, or behavioral report files exported as JSON. The skill works on exported files and does not inspect live systems.
Is this skill free to use?
The skill is licensed under Apache-2.0, as stated on this page. Check the license file in the ZIP for the full terms.
Does this skill tell me whether a file is malware?
No. It flags indicators of sandbox evasion for deeper manual review. The API and artifact lists are heuristic and can produce false positives on legitimate software.
Does the skill use the internet?
No. The skill is listed as not using the network, though it does run scripts, so review scripts/agent.py before running it.
Can I use it on a live incident response machine?
Not as intended. It works on exported report files and does not inspect systems directly, so it is not a fit for live incident response on production machines.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a malware analyst reviewing a sandbox report where a sample showed little or no activity, a detection engineer writing rules for anti-analysis behavior, or a student learning how evasion shows up in API traces. Pick a different tool if you need a verdict on whether a file is malicious or live response on production systems, since this skill produces heuristic indicators from exported reports only.
Download the skill