Work with PT Sandbox like a pro
Documentation: https://security-experts-community.github.io/sandbox-cli
Source Code: https://github.com/Security-Experts-Community/sandbox-cli
Installation
Using pipx:
pipx install sandbox-cli
Using PyPi:
pip install sandbox-cli
NixOS:
nix shell 'github:Security-Experts-Community/sandbox-cli'
Config
You must create default config file as described in docs/config-examples/config.toml:
Linux/MacOS:
~/.config/sandbox-cli/config.toml
or
$XDG_HOME_CONFIG_HOME/sandbox-cli/config.toml
Windows:
%APPDATA%\sandbox-cli\config.toml
Available options
scanner- Scan with the sandbox.images- Get available images in the sandbox.download- Download any artifact from the sandbox.email- Upload an email and get its headers.report- Generate short report from sandbox scans.unpack/conv- Convert sandbox logs into an analysis-friendly format.rules- Working with raw sandbox rules.
Usage examples
images
Get all availables images:
sandbox-cli images
┏━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┓
┃ Name ┃ ID ┃ Version ┃ Product version ┃
┡━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━┩
│ altlinux │ altworkstation-10-x64 │ ... │ ... │
│ astra │ astralinux-smolensk-x64 │ ... │ ... │
│ redos │ redos-murom-x64 │ ... │ ... │
│ ubuntu │ ubuntu-jammy-x64 │ ... │ ... │
│ Windows 10 Pro │ win10-1803-x64 │ ... │ ... │
│ Windows 10 Enterprise │ win10-22H2-x64 │ ... │ ... │
│ Windows 11 Pro │ win11-23H2-x64 │ ... │ ... │
│ Windows 7 Enterprise │ win7-sp1-x64 │ ... │ ... │
│ Windows 7 Enterprise │ win7-sp1-x64-ics │ ... │ ... │
└───────────────────────┴─────────────────────────┴────────────┴─────────────────┘
scanner
Scan the file on all available windows images with timeout 60s and with automatic logs unpacking:
sandbox-cli scanner scan-new -i windows -t 60 -U malware.exe
Development
uv is used to build the project.
uv sync
1 maintainer
Metadata
1 maintainer
Release files for sandbox-cli 0.3.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| sandbox_cli-0.3.4.tar.gz | 45.3 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| sandbox_cli-0.3.4-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 113.2 kB
Release files / sandbox_cli-0.3.4.tar.gz
| Download URL | sandbox_cli-0.3.4.tar.gz |
|---|---|
| Size | 45.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ddd59007b545f0d9e1d059560f4afc8395aac8a9b03f14c2c0248e9cc31a1787
|
|
BLAKE2b-256 checksum How to use checksums |
e8048f15ea6aee9823b99c71af287739db831b21cfd5a5f384d82b2a24a40f63
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.15
|
Release files / sandbox_cli-0.3.4-py3-none-any.whl
| Download URL | sandbox_cli-0.3.4-py3-none-any.whl |
|---|---|
| Size | 67.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
8adfda7cf347d3ae932303f0c5a17b3d2311e46a749795974888c3392d89950e
|
|
BLAKE2b-256 checksum How to use checksums |
b935db87d817585909622d3cfbee5a378f9cc366534706c49cc364ccd6b36c9f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.15
|
