Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
# AND — both conditions must match
domainName:"evil.com" AND destinationIP:"198.51.100.42"
# OR — either condition matches
sha256:"<HASH1>" OR sha256:"<HASH2>"
# NOT — exclude results
commandLine:"powershell*" NOT filePath:"*\\System32\\*"
# Grouping with parentheses
(domainName:"evil.com" OR domainName:"evil2.com") AND threatName:"Emotet"
# Complex query example — find samples that contact a C2 AND run PowerShell
domainName:"suspect-c2.example.com" AND commandLine:"powershell*"
Wildcard Characters
Wildcard
Meaning
Example
*
Any number of characters (including none)
filePath:"*\\Temp\\*.exe"
?
Exactly one character or none
domainName:"evil?.com"
^
Must start with (anchor start)
commandLine:"^powershell"
$
Must end with (anchor end)
filePath:"*.dll$"
# Files dropped in any user's Temp folder
filePath:"C:\\Users\\*\\AppData\\Local\\Temp\\*"
# Domains matching a pattern
domainName:"*.evil-infrastructure.com"
# Commands starting with specific binary
commandLine:"^reg.exe*"
# Files ending with specific extension
fileName:"*.hta$"
2. Free Tier Limitations
Feature
Free Plan
Paid Plans
TI Lookup requests
20 premium requests
Unlimited
Search fields
Basic (hashes, URLs, domains, IPs, MITRE, Suricata IDs) + AND
All 40+ fields + AND/OR/NOT
Results per query
10 most recent sandbox sessions
Full history
IOC/IOB/IOA detail
Full details from 10 most recent sessions
Full access all sessions
YARA Search requests
20 (shared pool with TI Lookup)
Unlimited
API access
Limited
Full REST API
Response time
~2-5 seconds
~2 seconds
Working Within Free Tier
# Maximize 20 requests: batch related IOCs with OR
sha256:"<HASH1>" OR sha256:"<HASH2>" OR sha256:"<HASH3>"
# Use basic fields that don't consume premium quota
# Free unlimited: file hashes, URLs, domains, IPs, MITRE techniques, Suricata IDs
# Prioritize lookups — check the most suspicious IOC first
# If a hash returns sandbox sessions, explore those sessions for related IOCs
# (exploring linked sessions in the web UI is free browsing, not a query)
3. Search Operator Recipes
Malware Family Identification
# Match a hash to known malware family
sha256:"<HASH>"
# If result includes threatName, pivot on it:
threatName:"AgentTesla"
# Find all samples of a family that contacted specific infrastructure
threatName:"QakBot" AND domainName:"*.example.com"
Behavioral Indicator Hunting
# Living-off-the-land binary abuse
commandLine:"*mshta*http*"
commandLine:"*certutil*-urlcache*-split*"
commandLine:"*bitsadmin*/transfer*"
commandLine:"*regsvr32*/s*/n*/u*/i:http*"
# Persistence mechanisms
registryKey:"*\\CurrentVersion\\Run\\*" AND commandLine:"powershell*"
# Credential access patterns
commandLine:"*sekurlsa*" OR commandLine:"*mimikatz*"
filePath:"*\\lsass*.dmp"
# Discovery commands
commandLine:"*net user*/domain*" AND commandLine:"*nltest*"
Network Infrastructure Correlation
# Find all samples contacting an IP
destinationIP:"<IP>"
# Find domains resolved to an IP
domainName:"*" AND destinationIP:"<IP>"
# Suricata-flagged traffic to engagement infrastructure
suricataMessage:"*<KEYWORD>*" AND destinationIP:"<IP>"
# Port-based filtering
destinationPort:"4444" AND destinationIP:"<IP>"
4. Correlating with Engagement Findings
Workflow: Hash Found on Compromised Host
# Step 1: Look up the hash in TI Lookup
curl -s "https://api.any.run/v1/intelligence/lookup" \
-H "Authorization: API-Key <ANYRUN_API_KEY>" \
-d '{"query": "sha256:\"<HASH>\""}' > /workspace/ti/hash_result.json
# Step 2: Extract key fields from result
python3 << 'PYEOF'
import json
with open('/workspace/ti/hash_result.json') as f:
data = json.load(f)
for task in data.get('data', {}).get('tasks', []):
print(f"Task ID: {task.get('uuid')}")
print(f"Verdict: {task.get('verdict')}")
print(f"Threat: {task.get('threatName', 'Unknown')}")
print(f"Tags: {', '.join(task.get('tags', []))}")
print(f"Created: {task.get('date')}")
print(f"Sandbox URL: https://app.any.run/tasks/{task.get('uuid')}")
print("---")
PYEOF
# Step 3: If match found, open sandbox session in browser for:# - Full process tree# - Network connections (C2 IPs/domains)# - Dropped files (additional IOCs)# - Registry modifications# - MITRE ATT&CK mapping
Workflow: Suspicious Domain from Network Logs
# Step 1: Query domain
curl -s "https://api.any.run/v1/intelligence/lookup" \
-H "Authorization: API-Key <ANYRUN_API_KEY>" \
-d '{"query": "domainName:\"<DOMAIN>\""}' > /workspace/ti/domain_result.json
# Step 2: Cross-reference with engagement timeline
python3 << 'PYEOF'
import json
with open('/workspace/ti/domain_result.json') as f:
ti_data = json.load(f)
# Extract all hashes that contacted this domain
related_hashes = set()
for task in ti_data.get('data', {}).get('tasks', []):
for ioc in task.get('iocs', {}).get('sha256', []):
related_hashes.add(ioc)
print(f"Malware family: {task.get('threatName', 'N/A')}")
print(f" Contacted domain at: {task.get('date')}")
if related_hashes:
print(f"\nRelated file hashes ({len(related_hashes)}):")
for h in sorted(related_hashes):
print(f" {h}")
# Check these hashes against host forensic images
PYEOF
Workflow: Pivot from C2 IP
# Step 1: Find all sandbox sessions that connected to the IP
curl -s "https://api.any.run/v1/intelligence/lookup" \
-H "Authorization: API-Key <ANYRUN_API_KEY>" \
-d '{"query": "destinationIP:\"<IP>\""}' > /workspace/ti/ip_result.json
# Step 2: Build IOC cluster
python3 << 'PYEOF'
import json
with open('/workspace/ti/ip_result.json') as f:
data = json.load(f)
domains = set()
hashes = set()
families = set()
for task in data.get('data', {}).get('tasks', []):
families.add(task.get('threatName', 'Unknown'))
# Collect all associated IOCs for the engagement reportprint(f"Malware families using this IP: {families}")
print(f"Use sandbox session URLs to extract dropped file hashes and additional C2 domains")
PYEOF
5. Integrating with Sandbox Analysis
When TI Lookup returns a match, the linked sandbox session provides deeper context:
Manual Web UI Workflow
Search at https://intelligence.any.run/ — paste IOC
Review results — each row is a sandbox session with verdict, threat name, tags
Extract IOCs from session — click "IOC" tab for auto-extracted indicators
Download PCAP — network capture from sandbox run for offline analysis
Export report — PDF/JSON for inclusion in engagement deliverables
Submitting New Samples to Sandbox
# Web submission: https://app.any.run/
# 1. Upload file or paste URL
# 2. Select OS (Windows 7/10/11, Linux)
# 3. Set analysis time (60-660 seconds)
# 4. Choose network simulation (residential proxy, Tor, custom)
# 5. Enable/disable: fake net, MITM proxy, HTTPS traffic capture
# 6. Run → watch in real-time → collect IOCs from results
# Free tier sandbox limits:
# - Windows 7 only (paid: Win 10/11, Linux)
# - 60-second timeout
# - Public submissions only (visible to community)
# - Limited to 3 concurrent tasks
Correlating Sandbox Results with Engagement
# After sandbox analysis, correlate network IOCs with engagement logs
python3 << 'PYEOF'
import json
# Load sandbox IOCs (exported from ANY.RUN session)
with open('/workspace/ti/sandbox_iocs.json') as f:
sandbox_iocs = json.load(f)
# Load engagement network logs
with open('/workspace/engagement/network_iocs.txt') as f:
engagement_ips = set(line.strip() for line in f)
# Find overlap
sandbox_ips = set(sandbox_iocs.get('destinationIPs', []))
overlap = sandbox_ips & engagement_ips
if overlap:
print(f"MATCH: {len(overlap)} IPs seen in both sandbox and engagement")
for ip in sorted(overlap):
print(f" {ip}")
print("\nThese IPs confirm the malware sample matches engagement activity")
else:
print("No IP overlap — sample may be different variant or unrelated")
PYEOF
These TI Lookup query patterns detect common attack behaviors:
Query Pattern
Detects
commandLine:"*powershell*-enc*"
Base64-encoded PowerShell execution
commandLine:"*wscript*//e:jscript*"
WScript JScript execution
filePath:"*\\Startup\\*.lnk"
LNK-based persistence
registryKey:"*\\Run\\*"
Registry run key persistence
suricataMessage:"ET TROJAN*"
Suricata-flagged trojan traffic
commandLine:"*certutil*-decode*"
LOLBin file decode abuse
destinationPort:"4444"
Default Metasploit/Meterpreter port
commandLine:"*schtasks*/create*"
Scheduled task persistence
Error Handling & Edge Cases
Problem
Cause
Solution
0 results for known-malicious hash
Sample not submitted to ANY.RUN
Submit to sandbox first, then re-query after analysis completes
API returns 429
Rate limit exceeded (free tier)
Wait and retry; batch queries with OR operator
API returns 401
Invalid or expired API key
Regenerate key at https://app.any.run/profile
Partial results (10 sessions only)
Free tier limit
Results ordered by recency — most relevant for active campaigns
Wildcard query too broad
domainName:"*" matches everything
Narrow with additional field: domainName:"*.evil.com" AND threatName:"Emotet"
Registry key query fails
Single backslash not escaped
Always use double backslash: registryKey:"HKCU\\Software\\..."
Old samples missing
Sessions older than retention window
Supplement with VirusTotal/MalwareBazaar for historical coverage
Combined search returns nothing
AND too restrictive
Loosen by removing one condition; try individual fields first
Decision Gate
IF you have a file hash from a compromised host
→ Query sha256:"<HASH>" first — fastest path to malware family identification
IF you have a suspicious domain from DNS logs
→ Query domainName:"<DOMAIN>" — reveals which malware families use it
IF you have a C2 IP from network monitoring
→ Query destinationIP:"<IP>" — find all sandbox sessions that contacted it
IF TI Lookup returns 0 results
→ Submit the sample to ANY.RUN sandbox, then re-query after analysis
IF you need behavioral correlation (LOLBins, persistence)
→ Use commandLine/registryKey/filePath fields with wildcards
IF free tier quota exhausted
→ Fall back to VirusTotal, MalwareBazaar, or manual sandbox analysis
IF results need to go into engagement report
→ Export sandbox session as PDF; include session URL as evidence link
