{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/docs/usage/getting_started.rst",
    "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/docs/usage/basic_usage.rst",
    "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/docs/usage/optional_features.rst",
    "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/docs/ipt.rst",
    "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/setup.py",
    "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/requirements.txt",
    "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/.gitmodules",
    "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/test/test_sanity.py",
    "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/test/conftest.py",
    "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/.github/workflows/build.yml",
    "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/LICENSE",
    "https://github.com/CERT-Polska/drakvuf-sandbox/releases/tag/v0.21.0"
  ],
  "category": "dynamic-analysis",
  "description_en": "CERT Polska’s automated black-box malware analysis system built on the DRAKVUF engine, which observes a Windows guest from the Xen hypervisor through virtual machine introspection rather than an agent installed in the guest. Samples submitted through the web interface or the CLI run in a restored snapshot, and the report covers the process tree, WinAPI, file and network activity, a PCAP, intercepted TLS keys, memory dumps, screenshots and capa-based TTP indicators. A drakrun installer builds the Windows guest, its snapshot and the VMI profile.",
  "description_zh": "CERT Polska 基于 DRAKVUF 引擎构建的自动化黑盒恶意软件分析系统，借助虚拟机自省从 Xen 虚拟机监控器一侧观察 Windows 客户机，无需在客户机中安装代理。通过 Web 界面或命令行提交的样本在恢复的快照中运行，报告涵盖进程树、WinAPI、文件与网络活动、PCAP、截获的 TLS 密钥、内存转储、截图以及基于 capa 的 TTP 指标。drakrun 安装命令负责构建 Windows 客户机、快照及 VMI 配置文件。",
  "entry_url": "https://awesomerea.org/resources/drakvuf-sandbox/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/drakvuf-sandbox/",
  "evidence_url": "https://github.com/CERT-Polska/drakvuf-sandbox/blob/7c328ab48bfe07b99c896c8695b7e51edf431ceb/README.md",
  "group": "tools",
  "id": "drakvuf-sandbox",
  "json_url": "https://awesomerea.org/resources/drakvuf-sandbox/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/drakvuf-sandbox/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/drakvuf-sandbox/index.md",
  "name": "DRAKVUF Sandbox",
  "name_zh": "DRAKVUF Sandbox 虚拟机监控器级恶意软件分析沙箱",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The reviewed master commit is the v0.21.0 release of 2026-08-19, which GitHub ships as a Python wheel; the drakvuf-sandbox package provides the drakrun CLI, web application and workers, needs Python 3.9+ and pins its dependencies, including flare-capa 7.4.0. The host needs an Intel CPU with VT-x and EPT and Debian 12 or Ubuntu 22.04 booted through GRUB into Xen 4.17+ (4.19 recommended); the getting-started guide asks for at least two cores and 8 GB of RAM, while the README says 5 GB. Xen, LibVMI and the DRAKVUF engine come from prebuilt .deb packages or source builds, Redis, dnsmasq, tcpdump and other host packages are added, and the documented installation runs as root.",
    "Guests are Windows 10 x64 (build 2004 or later, 22H2 recommended) or Windows 7 x64, installed by drakrun install from a Windows installation ISO the user supplies and completed over VNC, then snapshotted and profiled by drakrun postinstall. The guide suggests turning off UAC and Windows Defender in the reference snapshot and adding Visual C++ and .NET runtimes, and each analysis can cut the guest’s internet access. Nested virtualization works under Xen, under KVM as experimental, and under VMware Workstation with virtualized EPT; cloud hosts, Hyper-V and VMware Fusion are unsupported.",
    "Observations come from DRAKVUF plugins: apimon, filetracer, memdump, procmon, socketmon and tlsmon by default, with regmon, syscalls, exmon and others optional and Intel Processor Trace plugins documented as experimental. The docs warn that many plugins slow execution, that monitoring begins only after the sample process starts, and that summary observations derive from DRAKVUF output, so exact network data should be checked in the PCAP. S3 storage, a ZFS storage backend and Karton integration are optional.",
    "Profiling injects a small drakshell shellcode agent into explorer.exe for preparation commands. The repository carries source for drakshell and other guest helpers, a 15 KB test/test.exe sample used by its sanity test, and pinned DRAKVUF and Mandiant capa-rules submodules. That test suite installs the sandbox on a VM-runner service needing project credentials, while the public workflow only builds the docs, tools, web bundle and wheel and lints the Python code. The README warns that maintaining a sandbox is difficult and bugs may reproduce only on one configuration.",
    "LICENSE applies GPL-2.0 with the authors’ added clarifications and exceptions, including a broad reading of derivative works and a bar on combining it with plain-GPL software, so GitHub reports no standard license; DRAKVUF and the capa rules keep their own licenses, and Windows guests remain under Microsoft’s terms. It is a defensive platform for running untrusted samples in isolated guests."
  ],
  "requirements_zh": [
    "所审阅的 master 提交即 2026-08-19 发布的 v0.21.0，GitHub 发布页以 Python wheel 形式提供；drakvuf-sandbox 软件包包含 drakrun 命令行、Web 应用和工作进程，要求 Python 3.9+ 并固定依赖版本，其中包括 flare-capa 7.4.0。主机需要支持 VT-x 和 EPT 的 Intel 处理器，运行 Debian 12 或 Ubuntu 22.04 并通过 GRUB 引导进入 Xen 4.17+（推荐 4.19）；入门指南要求至少两个核心和 8 GB 内存，README 则写 5 GB。Xen、LibVMI 和 DRAKVUF 引擎可使用预编译 .deb 软件包或从源码构建，另需安装 Redis、dnsmasq、tcpdump 等主机软件包，文档中的安装步骤均以 root 身份执行。",
    "客户机为 Windows 10 x64（2004 或更高版本，推荐 22H2）或 Windows 7 x64，由 drakrun install 使用使用者自备的 Windows 安装 ISO 安装，经 VNC 完成设置，再由 drakrun postinstall 创建快照并生成配置文件。指南建议在参考快照中关闭 UAC 和 Windows Defender，并安装 Visual C++ 与 .NET 运行库；每次分析都可以切断客户机的互联网访问。嵌套虚拟化可在 Xen、KVM（实验性）以及启用虚拟化 EPT 的 VMware Workstation 下运行；不支持云主机、Hyper-V 和 VMware Fusion。",
    "观测数据来自 DRAKVUF 插件：默认启用 apimon、filetracer、memdump、procmon、socketmon 和 tlsmon，regmon、syscalls、exmon 等为可选，Intel Processor Trace 相关插件在文档中标为实验性。文档提醒，插件过多会拖慢执行；监控在样本进程启动之后才开始；摘要中的观测基于 DRAKVUF 输出，确切的网络数据应查看 PCAP。S3 存储、ZFS 存储后端和 Karton 集成均为可选功能。",
    "生成配置文件时，系统会把名为 drakshell 的小型 shellcode 代理注入 explorer.exe，用于执行准备命令。仓库包含 drakshell 及其他客户机辅助工具的源码、供完整性测试使用的 15 KB 样本 test/test.exe，以及固定版本的 DRAKVUF 和 Mandiant capa-rules 子模块。该测试套件需在需要项目凭据的 VM-runner 服务上安装沙箱，公开工作流只构建文档、工具、Web 包和 wheel，并检查 Python 代码规范。README 提醒维护沙箱并不容易，某些问题可能只在特定配置下复现。",
    "LICENSE 采用附加了作者澄清与例外条款的 GPL-2.0，其中包括对衍生作品的宽泛解释，并禁止与普通 GPL 软件组合，因此 GitHub 未识别出标准许可证；DRAKVUF 和 capa 规则各有其许可，Windows 客户机仍受 Microsoft 条款约束。这是在隔离客户机中运行不可信样本的防御性分析平台。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/CERT-Polska/drakvuf-sandbox",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}