The lab is already built.

Some cases need manual analysis. The CSI module in Threat.Zone is a pre-configured forensic environment, so the work starts without a setup.

See Threat.Zone

The lab opens beside the report.

One click on the automated report opens a terminal that already holds what the sandbox collected: the dropped files, the memory dump, the capture, and the tools to take them apart.

_____ _ _ _____ ____ ____ ___ ____ ____ ___ |_ _| |__ _ __ ___ __ _| |_ |__ /___ _ __ ___ / ___/ ___|_ _| / ___/ ___|_ _| | | | '_ \| '__/ _ \/ _` | __| / // _ \| '_ \ / _ \ | | \___ \| | | | \___ \| | | | | | | | | | __/ (_| | |_ _ / /| (_) | | | | __/ | |___ ___) | | | |___ ___) | | |_| |_| |_|_| \___|\__,_|\__(_)____\___/|_| |_|\___| \____|____/___| \____|____/___| Threat.Zone CSI - Crime Scene Investigation - Module is designed to provide tools and test environment for analysts. Installed Tools: YARA: YARA is an open-source tool designed to help malware researchers identify and classify malware samples. Radare2: UNIX-like reverse engineering framework and command-line toolset. Rekall Framework: The Rekall Framework is a completely open collection of tools for the extraction and analysis of digital artifacts computer systems. Fq: Tool, language and decoders for working with binary data. csi@csi-7f3a2c1e-x1rk4:~$ ls dropped/ memory.dmp traffic.pcap report.json csi@csi-7f3a2c1e-x1rk4:~$ ls dropped loader.dll stage2.bin run.vbs csi@csi-7f3a2c1e-x1rk4:~$ yara -r rules dropped Win32_ReflectiveLoader dropped/loader.dll Generic_XOR_Payload dropped/stage2.bin csi@csi-7f3a2c1e-x1rk4:~$ r2 -qc iz~http dropped/stage2.bin 0x00412a10 30 http://203.0.113.7/gate.php csi@csi-7f3a2c1e-x1rk4:~$

The problem

Automation answers most questions. Some samples need a person: a packer nobody has seen, a loader that waits, a case that has to hold up in a report.

Manual analysis needs a lab. Building one means machines, tools, snapshots and licenses, kept up to date by someone who would rather be analyzing.

So the lab is often the thing that is missing when the case arrives.

The answer

The CSI module in Threat.Zone is the path to manual analysis. It is a pre-configured forensic environment, opened from the same platform that ran the automated analysis.

The lab capabilities streamline the manual work. The tools an investigator needs are already in place, alongside the report the sandbox and static analysis produced.

It is where cybersecurity meets CSI investigation.

In practice.

Where it sits: Inside Threat.Zone, next to the automated report on the same sample.
What happens to the file: It is analyzed by hand, in a forensic environment that was ready before the sample arrived. Static analysis and the sandbox have already done the first pass.
Powered by: Threat.Zone Sandbox Static analysis