Sandbox detonation reports

Detects sandbox detonation reports: sandbox or dynamic-analysis report wording with populated behaviour fields (verdict, task ID, spawned processes, dropped files, registry keys, network requests) and host artefacts. Topic wording alone is discovery-only.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a labelled behaviour field (verdict, score, task ID, hash, spawned process, dropped file, mutex, registry key, DNS/HTTP request) or a host artefact (registry path, Windows file path, SHA256, IP:port)), and 85 needs two distinct structures plus independent behaviour-context (malicious, evasion, persistence, injection, beaconing, ATT&CK) evidence, so policies, blank forms and training text stay below 75.

Detection quality

Topic false positive

Jurisdictions

global

Regulations

Security of Critical Infrastructure Act 2018 (Cth)

Frameworks

ISO 27001, NIST CSF

Data categories

security

Scope

wide

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:sandbox\s+(?:detonation|analysis|report|results?|verdict)|detonation\s+(?:report|results?|chamber)|dynamic\s+analysis\s+report|(?:Cuckoo|CAPE|Joe\s+Sandbox|ANY\.RUN|Hybrid\s+Analysis|WildFire)\s+(?:report|analysis|verdict))\b

Corroborative evidence keywords

malicious, evasion, persistence, process injection, beacon, network activity, MITRE ATT&CK, signature matched, anti-VM, screenshot

Proximity: 300 characters

Should match

• The attachment was sent for sandbox analysis before release to the user. — Discovery probe (65)
• Sandbox report - task 88213 Dropped file: svcupd.exe — Medium-tier probe (75) - one populated behaviour field
• CAPE report - analysis of invoice_0912.docm Verdict: malicious (threat score 9/10) Spawned process: powershell.exe -enc JABjAGwA Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svcupd Network activity: beacon to 185.220.101.47:443 every 60 s; persistence via Run key. — High-tier probe (85) - multiple behaviour fields, registry path, IP:port, behaviour context

Should not match

• unrelated generic text — No relevant phrase context
• placeholder value 12345 — Random text should not match
• Policy statement: suspicious attachments are submitted for sandbox analysis before quarantine release. — Policy text
• Sandbox report template Verdict: ________ Spawned process: [insert] — Blank template
• Course module 4: reading a sandbox report - verdict: malicious, registry key: HKCU\Software\Run\x — Training framing

Known false positives

• Sandbox vendor documentation shows report fields. Mitigation: Fields must carry values; guidance/training framing is excluded.

References

• Information Security Manual (ISM)
• Security of Critical Infrastructure Act 2018 (Cth)
• Data breach preparation and response (OAIC)
• APRA CPS 234 Information Security
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• MITRE ATT&CK