It might not be feasible for you to invest development resources into a sandbox for malware analysis. There's merit in #2 and #3, but it all depends on the organization's needs and the available resources to allocate to these options. The easiest solutions with the least amount of spin up time are #1 and #4. Toss it into a VM along with a few tools in the hopes of being able to figure out what it's doing.Develop an in-house solution from scratch which you'll need to continue to put resources into in order to maintain it and update it over time.Utilize an open-source solution that requires many hours of internal development, continued maintenance, and has limited features with community-based support which tends to be unreliable at the best of times.Pay for an expensive subscription service that will cost your organization thousands of dollars per year.Your options are typically something along the lines of: However, your organization doesn't actually pay for or manage any sort of malware sandbox - or they do manage one, but it's totally busted or completely out-of-date because nobody has been managing it, and thus you don't really have any official means to safely run and analyze that maldoc or executable that was sent your way!Įnter the ever-present issue in the Cyber Security world of needing to detonate malware, but not necessarily having somewhere safe or established to do it within your organization.

If you work in an organization's IT department, a CERT/CIRT, SOC, or just generally in the world of IT or Cyber Security, odds are someone in your organization has downloaded a shady file or received an email with some shady attachments and asked you to analyze them.

Pestudio paloalto