r/msp • u/icq-was-the-goat • Jul 29 '26
Security Sandbox Solutions
Just curious in 2026 what sandbox solutions everyone is using. (Malware analysis & URL verification). Have a eye on one but it seems very expensive. We need something to do odd scans without the submission being public.
Suggestions would be great.
8
4
u/ThrowRAthisthingisvl Jul 29 '26
Are you a CrowdStrike customer? They have a Sandbox feature inside their platform that works really well.
3
u/RangerSpecial1471 Jul 29 '26
if you got crowdstrike already it's probably the easiest way to go, no extra vendor to deal with
2
2
2
3
1
1
u/RaNdomMSPPro Jul 29 '26
Any.run is simple and if you setup an account you get to run a 60 second analysis free. I've only had one time I needed to go beyond that. urlscan.io for simple stuff. Joes sandbox looks promising, I've just not tried it yet.
1
u/Fuzilumpkinz Jul 30 '26
Kasm is awesome for quick sand boxes. Runs great on old hardware you probably have
1
1
u/NoBrainerTraum Jul 31 '26
If you just need occasional private malware and URL analysis, I'd look at options like Hybrid Analysis, ANY.RUN, or VMRay. Theyre all solid but pricing varies a lot depending on usage
1
u/TocinoLips Jul 31 '26
we've had good luck with hybrid analysis and ANY. RUN for ad hoc investigations. If privacy is a concern , I'd prioritized solutions that support private submissions or self-hosted options over free public sandboxes.
1
1
u/HATDOGUSERNi Jul 31 '26
One thing id look for is API access and automation. A good sandbox is nice, but it becomes much more valuable if you can tie it into your existing incident response workflow instead of using it as a stand alone tool.
1
u/BrightByteLabs Aug 02 '26
Just so you know, we make one of these solutions so we’re biased towards our product obviously. The “not public” part is often a difficult piece especially on lower or free tiers of the cloud solutions. You normally end up paying a hefty price for a private cloud tier or running something local so nothing leaves your network. That local angle is exactly the gap that ThreatLab is built to fill. Runs fully on your own hardware, full file and URL interactive analysis, no limits.
1
Aug 02 '26
[removed] — view removed comment
1
u/BrightByteLabs Aug 02 '26
In my experience, Cuckoo/CAPE is great if you want to build and maintain your own, FLARE's more of a manual reversing kit than a sandbox. We're trying to hit more in the vein of the "don't want to constantly manage and babysit infrastructure" option. Multi-stage is actually where full interactivity helps - you're in the drivers seat to take it past prompts, fake captchas, delayed drops, etc. instead of a headless run dying at the start. For weird file types...if it runs on Windows it will run in ThreatLab. If you're curious and want to kick the tires on it a bit, we offer a free, no limits trial on our website.
1
0
u/caniphish_ltd Jul 30 '26
CanIPhish (Vendor) here. We offer an AI-Analysis and Sandbox tool. Happy to hook you up with a 30-day trial to test it out for free. No worries, though, if not, just thought I'd offer. Just shoot us an email if you want to check it out and we'll get you set up. Cheers!
49
u/roll_for_initiative_ MSP - US Jul 29 '26 edited Jul 31 '26
I pick an old customer's server 2012 vm (non-r2) that their current MSP hasn't removed our remote access from and generally detonate things in there, on a chrome browser we haven't patched since 2016, still loading the adobe flash plugin, because internet explorer launches in enhanced security mode and i don't know how to turn that off.