Skip to content

PROFILES.md

Latest commit

 

History

History
223 lines (151 loc) · 3.64 KB

PROFILES.md

File metadata and controls

223 lines (151 loc) · 3.64 KB
Raw

Install Profiles

Overview

Profiles control tool selection and sandbox networking posture.

Notes:

  • 7zip is included as a bootstrap dependency for archive-based tools in all profiles.
  • Some tools are intentionally marked manual/advanced in this pass instead of pretending full automation.
  • New Windows 11 operational presets are available: analysis, detonation, and forensics.

minimal

Use when: Fast baseline with editors/runtime + Sysinternals.

Networking: ❌ Disabled

Core tools:

  • 7-Zip
  • Visual Studio Code
  • Notepad++
  • Python 3
  • Sysinternals Suite
.\Start-Sandbox.ps1 -Profile minimal

reverse-engineering (default)

Use when: General malware RE/static analysis.

Networking: ❌ Disabled

Adds to minimal:

  • Corretto 21
  • Visual C++ Redist x64
  • Ghidra
  • x64dbg
  • dnSpyEx
  • Detect-It-Easy
  • UPX
  • PE-bear
  • pestudio
  • HxD
  • FLARE FLOSS
.\Start-Sandbox.ps1 -Profile reverse-engineering

network-analysis

Use when: Network capture/inspection workflows.

Networking: ✅ Enabled

Adds to reverse-engineering:

  • Wireshark
  • Npcap (manual install)
.\Start-Sandbox.ps1 -Profile network-analysis

analysis

Use when: Daily malware-analysis workstation with internet-enabled enrichment.

Networking: ✅ Enabled

Core pack:

  • Reverse-engineering baseline (ghidra, x64dbg, dnSpyEx, DIE, UPX, PE-bear, pestudio, HxD, FLOSS)
  • Sysinternals Suite
  • Dependencies
  • Wireshark + Npcap
.\Start-Sandbox.ps1 -Profile analysis

detonation

Use when: Restricted detonation with tighter host interaction and no network by default.

Networking: ❌ Disabled

Core pack:

  • Sysinternals Suite
  • Detect-It-Easy
  • Dependencies
  • FLOSS
  • API Monitor (manual/advanced)
  • ProcDOT (manual/advanced)
.\Start-Sandbox.ps1 -Profile detonation -DisableClipboard

forensics

Use when: Offline file triage and static forensics.

Networking: ❌ Disabled

Core pack:

  • Sysinternals Suite
  • Detect-It-Easy
  • Dependencies
  • UPX
  • PE-bear
  • pestudio
  • HxD
  • FLOSS
.\Start-Sandbox.ps1 -Profile forensics

triage-plus

Use when: Rapid triage with lightweight static + network tooling.

Networking: ✅ Enabled

Core pack:

  • Sysinternals Suite
  • Detect-It-Easy
  • Dependencies
  • Wireshark
.\Start-Sandbox.ps1 -Profile triage-plus

reverse-windows

Use when: Windows-focused reverse/debug/runtime tracing.

Networking: ❌ Disabled

Core pack:

  • x64dbg
  • Detect-It-Easy
  • Dependencies
  • API Monitor (manual/advanced)
  • ProcDOT (manual/advanced)
.\Start-Sandbox.ps1 -Profile reverse-windows

behavior-net

Use when: Behavior + network correlation workflows.

Networking: ✅ Enabled

Core pack:

  • Sysinternals Suite
  • Wireshark
  • API Monitor (manual/advanced)
  • ProcDOT (manual/advanced)
.\Start-Sandbox.ps1 -Profile behavior-net

dev-windows

Use when: Developer/debugger workstation inside sandbox.

Networking: ❌ Disabled

Core pack:

  • Visual Studio Community (manual/heavy)
  • Windows SDK (manual/workflow-coupled)
  • Sysinternals Suite
.\Start-Sandbox.ps1 -Profile dev-windows

full

Use when: Entire catalog.

Networking: ✅ Enabled

Includes all tools in tools.json.

.\Start-Sandbox.ps1 -Profile full

Deferred In This Pass

  • REMnux bundling (Linux/container-oriented; planned for later helper/container work).
  • VirusTotal Windows uploader bundling (official uploader is no longer maintained by VirusTotal).