Work with PT Sandbox like a pro
Documentation: https://security-experts-community.github.io/sandbox-cli
Source Code: https://github.com/Security-Experts-Community/sandbox-cli
Installation
Using pipx:
pipx install sandbox-cli
Using PyPi:
pip install sandbox-cli
NixOS:
nix shell 'github:Security-Experts-Community/sandbox-cli'
Config
You must create default config file as described in docs/config-examples/config.toml:
Linux/MacOS:
~/.config/sandbox-cli/config.toml
or
$XDG_HOME_CONFIG_HOME/sandbox-cli/config.toml
Windows:
%APPDATA%\sandbox-cli\config.toml
Available options
scanner- Scan with the sandbox.images- Get available images in the sandbox.download- Download any artifact from the sandbox.email- Upload an email and get its headers.report- Generate short report from sandbox scans.unpack/conv- Convert sandbox logs into an analysis-friendly format.rules- Working with raw sandbox rules.
Usage examples
images
Get all availables images:
sandbox-cli images
┏━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┓
┃ Name ┃ ID ┃ Version ┃ Product version ┃
┡━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━┩
│ altlinux │ altworkstation-10-x64 │ ... │ ... │
│ astra │ astralinux-smolensk-x64 │ ... │ ... │
│ redos │ redos-murom-x64 │ ... │ ... │
│ ubuntu │ ubuntu-jammy-x64 │ ... │ ... │
│ Windows 10 Pro │ win10-1803-x64 │ ... │ ... │
│ Windows 10 Enterprise │ win10-22H2-x64 │ ... │ ... │
│ Windows 10 Pro │ win11-23H2-x64 │ ... │ ... │
│ Windows 7 Enterprise │ win7-sp1-x64 │ ... │ ... │
│ Windows 7 Enterprise │ win7-sp1-x64-ics │ ... │ ... │
└───────────────────────┴─────────────────────────┴────────────┴─────────────────┘
scanner
Scan the file on all available windows images with timeout 60s and with automatic logs unpacking:
sandbox-cli scanner scan-new -i windows -t 60 -U malware.exe
Development
uv is used to build the project.
uv sync
1 maintainer
Metadata
1 maintainer
Release files for sandbox-cli 0.3.2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| sandbox_cli-0.3.2.tar.gz | 45.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| sandbox_cli-0.3.2-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 113.0 kB
Release files / sandbox_cli-0.3.2.tar.gz
| Download URL | sandbox_cli-0.3.2.tar.gz |
|---|---|
| Size | 45.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
489bc36f25046cc43398a75d1acf0be406ca787cfb00cd08ddaa106cb79640b2
|
|
BLAKE2b-256 checksum How to use checksums |
aef67b8fe90c8382562315b23a42dc0e7ec7f03dd491d5b0a7413d5553eec03c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.15
|
Release files / sandbox_cli-0.3.2-py3-none-any.whl
| Download URL | sandbox_cli-0.3.2-py3-none-any.whl |
|---|---|
| Size | 67.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
ab4bcbd2bc35ee943fd5fd7b66c0163c7708b6e0cd79f319806c9ec25b4fbc40
|
|
BLAKE2b-256 checksum How to use checksums |
ebd4d404c1aad0976c3dcca0907b1278dc6e9dacc1f11d80323e6f5f91089fbf
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.15
|
