{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://github.com/Rurik/Noriben/blob/4c84a98601fd7a9559c8b225b5968159efb7dcc0/Noriben.py#L1410-L1465",
    "https://github.com/Rurik/Noriben/blob/4c84a98601fd7a9559c8b225b5968159efb7dcc0/Noriben.config",
    "https://github.com/Rurik/Noriben/blob/4c84a98601fd7a9559c8b225b5968159efb7dcc0/LICENSE",
    "https://github.com/Rurik/Noriben/releases/tag/2.1.0"
  ],
  "category": "dynamic-analysis",
  "description_en": "Python script that drives Sysinternals Process Monitor to record what a program does while it runs, filters out routine system activity and writes a text report of the processes it created and its file, registry and network activity. It works as a lightweight malware sandbox and can also log events while the analyst runs a sample by hand, with command-line options, user interaction or under a debugger; created files can be scanned with YARA rules and their hashes looked up on VirusTotal. Version 2.1.0 adds DLL-load monitoring, an ASCII process tree and JSON output, and NoribenSandbox.py automates runs inside a guest VM.",
  "description_zh": "调用 Sysinternals Process Monitor 记录程序运行时行为的 Python 脚本，会滤除常规系统活动，并生成文本报告，列出程序创建的进程及其文件、注册表和网络活动。它可以当作轻量级恶意软件沙箱使用，也能在分析人员手动运行样本时记录事件，例如样本需要特定命令行参数、需要用户交互，或在调试器中单步执行时。新建的文件可用 YARA 规则扫描，其哈希值可在 VirusTotal 上查询。2.1.0 版新增 DLL 加载监控、ASCII 进程树和 JSON 输出；NoribenSandbox.py 可在客户机虚拟机中自动完成分析流程。",
  "entry_url": "https://awesomerea.org/resources/noriben/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/noriben/",
  "evidence_url": "https://github.com/Rurik/Noriben/blob/4c84a98601fd7a9559c8b225b5968159efb7dcc0/README.md",
  "group": "tools",
  "id": "noriben",
  "json_url": "https://awesomerea.org/resources/noriben/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/noriben/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/noriben/index.md",
  "name": "Noriben",
  "name_zh": "Noriben 基于 Procmon 的恶意软件行为分析脚本",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "scope",
    "limits",
    "testing",
    "license"
  ],
  "requirements": [
    "Python 3 and Sysinternals procmon.exe or procmon64.exe on the Windows analysis machine; yara-python is optional for --yara scans and requests for VirusTotal lookups. Release at review: 2.1.0, published 2026-11-03, whose tag is the reviewed main commit.",
    "The README's sandbox workflow runs a sample in a VM, copies the results off and reverts before the next sample. NoribenSandbox.py starts a predefined VM snapshot, copies in the sample, runs Noriben and retrieves a ZIP report and a screenshot; the README says this front end currently runs on macOS hosts.",
    "With a VirusTotal API key it looks up file hashes; uploading every created file to VirusTotal happens only when virustotal_upload is set to True in Noriben.config, which defaults to False.",
    "The 2.1.0 notes add large-scale unit testing, developed with AI assistance; the README runs tests/unit_tester.ps1 through Noriben in a Windows VM with Procmon module loads enabled.",
    "Apache-2.0 per the README and LICENSE."
  ],
  "requirements_zh": [
    "Windows 分析机上需要 Python 3 以及 Sysinternals 的 procmon.exe 或 procmon64.exe；使用 --yara 扫描需另装 yara-python，查询 VirusTotal 需要 requests。审阅时的版本为 2.1.0，于 2026-11-03 发布，其标签即所审阅的 main 分支提交。",
    "README 描述的沙箱流程是在虚拟机中运行样本、取回结果，并在分析下一个样本前恢复快照。NoribenSandbox.py 会启动预设的虚拟机快照，复制样本进去，运行 Noriben，再取回 ZIP 格式的报告和截图；README 称这个前端目前在 macOS 主机上运行。",
    "配置 VirusTotal API 密钥后，它会查询文件哈希；只有在 Noriben.config 中把 virustotal_upload 设为 True（默认为 False）时，才会把所有新建文件上传到 VirusTotal。",
    "2.1.0 版的发布说明提到新增了大规模单元测试，并说明是在 AI 辅助下开发的；README 给出的测试方法是在启用了 Procmon 模块加载记录的 Windows 虚拟机中，通过 Noriben 运行 tests/unit_tester.ps1。",
    "依 README 与 LICENSE 采用 Apache-2.0 许可。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/Rurik/Noriben",
  "verification": "source-reviewed",
  "verified_at": "2026-11-05"
}