sandbox-cli

Work with PT Sandbox like a pro

Documentation: https://security-experts-community.github.io/sandbox-cli

Source Code: https://github.com/Security-Experts-Community/sandbox-cli

Installation

Using pipx:

pipx install sandbox-cli

Using PyPi:

pip install sandbox-cli

NixOS:

nix shell 'github:Security-Experts-Community/sandbox-cli'

Config

You must create default config file as described in docs/config-examples/config.toml:

Linux/MacOS:

~/.config/sandbox-cli/config.toml
or
$XDG_HOME_CONFIG_HOME/sandbox-cli/config.toml

Windows:

%APPDATA%\sandbox-cli\config.toml

Available options

scanner - Scan with the sandbox.
images - Get available images in the sandbox.
download - Download any artifact from the sandbox.
email - Upload an email and get its headers.
report - Generate short report from sandbox scans.
unpack/conv - Convert sandbox logs into an analysis-friendly format.
rules - Working with raw sandbox rules.

Usage examples

images

Get all availables images:

sandbox-cli images

┏━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┓
┃ Name                  ┃ ID                      ┃ Version    ┃ Product version ┃
┡━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━┩
│ altlinux              │ altworkstation-10-x64   │ ...        │ ...             │
│ astra                 │ astralinux-smolensk-x64 │ ...        │ ...             │
│ redos                 │ redos-murom-x64         │ ...        │ ...             │
│ ubuntu                │ ubuntu-jammy-x64        │ ...        │ ...             │
│ Windows 10 Pro        │ win10-1803-x64          │ ...        │ ...             │
│ Windows 10 Enterprise │ win10-22H2-x64          │ ...        │ ...             │
│ Windows 10 Pro        │ win11-23H2-x64          │ ...        │ ...             │
│ Windows 7 Enterprise  │ win7-sp1-x64            │ ...        │ ...             │
│ Windows 7 Enterprise  │ win7-sp1-x64-ics        │ ...        │ ...             │
└───────────────────────┴─────────────────────────┴────────────┴─────────────────┘

scanner

Scan the file on all available windows images with timeout 60s and with automatic logs unpacking:

sandbox-cli scanner scan-new -i windows -t 60 -U malware.exe

Development

uv is used to build the project.

uv sync

Metadata

Release files for sandbox-cli 0.3.3

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for sandbox-cli 0.3.3
File	Size	Uploaded
sandbox_cli-0.3.3.tar.gz	45.3 kB	Sep 18, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for sandbox-cli 0.3.3
File	Interpreter	ABI	Platform	Reset
sandbox_cli-0.3.3-py3-none-any.whl 67.9 kB Sep 18, 2026	Python 3	none	any	Details

Total release size: 113.2 kB

Release files / sandbox_cli-0.3.3.tar.gz

Download URL	sandbox_cli-0.3.3.tar.gz
Size	45.3 kB
Tags	Source
SHA-256 checksum How to use checksums	`a4afcae9b46d0712edbc2a96323dfc6ccb83064f7a8aafdbe4ced2f5289bb89a`
BLAKE2b-256 checksum How to use checksums	`072b9b1bca45ce25720f1d4fc1ab3141979865537b883f72ed63f531d5e15911`
Upload date	Sep 18, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.13.15`

Release files / sandbox_cli-0.3.3-py3-none-any.whl

Download URL	sandbox_cli-0.3.3-py3-none-any.whl
Size	67.9 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`02dd1576694d122f6dd1995880689061579f713661ed652df844c7abb61af1f8`
BLAKE2b-256 checksum How to use checksums	`e801cadff50ab2924bfccc6c3a7b6a7e07d2c6e04871438840bc1575a95348e8`
Upload date	Sep 18, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.13.15`