🏖️ Rusty Sand

Advanced Windows Sandbox with Real-Time Host Intrusion Prevention System (HIPS)

Rusty Sand is a executable sandbox for Windows security research that i've made providing real-time API interception, behavioral threat detection, and interactive control over every operation a program performs. Unlike passive sandboxes that monitor after-the-fact, Rusty Sand implements a true HIPS that intercepts operations BEFORE execution using DLL injection and API hooking.

⚠️For defensive security research only. Run on isolated VMs, never on production systems.

---

Showcase

🌟 Key Features

🛡️ Real-Time API Interception (HIPS)

• DLL Injection: Injects hook DLL into target process using CreateRemoteThread

• MinHook Integration: Inline API hooking for Windows functions

• Pre-Execution Blocking: Operations intercepted BEFORE they execute

• Named Pipe IPC: Secure communication between main process and hook DLL

• Modular Architecture: Hooks organized by category (file, folder, network, registry, process, memory) ✨ NEW

• Hooked APIs (17 critical Windows functions - +112% coverage):

  File Operations (2 hooks):

  • CreateFileW - File creation and modification
  • DeleteFileW - File deletion

  Folder Operations (2 hooks):

  • CreateDirectoryW - Folder creation
  • RemoveDirectoryW - Folder deletion

  Network Operations (1 hook):

  • connect - Network connections (TCP/UDP)

  Registry Operations (4 hooks):

  • RegSetValueExW - Registry value writes
  • RegDeleteKeyW - Registry key deletion
  • RegQueryValueExW - Registry value reads
  • RegOpenKeyExW - Registry key opens

  Process/Thread Operations (3 hooks) ✨ NEW:

  • CreateProcessW - Child process creation
  • CreateThread - Thread creation
  • CreateRemoteThread - Remote thread injection (CRITICAL for detecting process injection)

  Memory/DLL Operations (5 hooks) ✨ NEW:

  • VirtualAlloc - Memory allocation (detects RWX allocations)
  • VirtualProtect - Memory protection changes (detects DEP bypasses)
  • WriteProcessMemory - Cross-process memory writes (detects code injection)
  • LoadLibraryW - DLL loading (detects DLL injection)
  • LoadLibraryExW - Extended DLL loading

🎯 Real-Time Risk Scoring ✨ NEW

• Intelligent Threat Assessment: Every intercepted operation analyzed in real-time
• 0-100 Risk Score: Quantitative threat rating based on multiple factors
• Threat Categorization: Four-tier classification system
  • 🟢 LOW (0-30): Normal operations, minimal risk
  • 🟡 MEDIUM (31-60): Potentially suspicious, warrants attention
  • 🟠 HIGH (61-85): Likely malicious, strong indicators
  • 🔴 CRITICAL (86-100): Almost certainly malicious, immediate action recommended
• Context-Aware Analysis: Scoring considers operation type, target location, parameters
• Smart Filtering: Auto-allows read-only operations to reduce prompt fatigue by ~60%
• Detection Patterns:
  • Persistence: Registry Run keys (+65 risk), Startup folders (+60 risk)
  • Code Injection: Remote thread creation (+95 risk), cross-process memory writes (+85 risk)
  • DEP Bypass: RWX memory allocation (+65 risk), memory protection changes (+60 risk)
  • Ransomware: .encrypted/.locked extensions (+70 risk), rapid file operations
  • UAC Bypass: Environment variable manipulation (+70 risk)
  • Security Tampering: Windows Defender/Firewall modifications (+70 risk)
  • C2 Communication: Suspicious ports 4444/31337 (+55 risk), large data exfiltration (+40 risk)
  • Living-off-the-Land: PowerShell encoded commands (+50 risk), LOLBAS abuse (+40 risk)

🔍 Comprehensive Monitoring

• File System: File/folder creation, modification, deletion (real-time via API hooks)
• Network: TCP/UDP connections (intercepted before connect)
• Registry: Registry operations (intercepted before modification)
• Processes: Complete process tree tracking with Toolhelp32

🚨 Behavioral Threat Detection

Automatically detects:

• Ransomware: Rapid file encryption, suspicious extensions (.encrypted, .locked)
• Persistence: Registry Run keys, startup folders, scheduled tasks
• Process Injection: Remote thread creation, cross-process memory writes ✨ NEW
• Code Execution: RWX memory allocation, DEP bypass attempts ✨ NEW
• DLL Injection: Suspicious DLL loading from temp directories ✨ NEW
• UAC Bypass: Environment variable manipulation, ms-settings abuse
• Security Tampering: Windows Defender/firewall modifications
• C2 Communications: Suspicious ports (4444, 8080, 31337), large data transfers ✨ NEW
• PowerShell Abuse: Encoded commands, download cradles, hidden window execution
• Folder Operations: Suspicious folder creation/deletion (ProgramData, System32)

🔒 Process Isolation

• Windows Job Objects: Hard resource limits (memory, CPU)
• CREATE_SUSPENDED: Process starts suspended until user approval
• Process Tree Control: Suspend/resume using Toolhelp32 + threading APIs
• Network Isolation: Internet access OFF by default
• Dual Console: Target runs in separate window (clean monitoring UI)

📊 Professional Reporting

• Color-coded Console Output: Events with icons and risk levels
• JSON Exports: Comprehensive machine-readable reports
• Event Statistics: Breakdown by operation type
• Threat Summaries: Detected behavioral patterns

---

🏗️ Architecture

Two-Process Design

Rusty Sand uses a sophisticated two-process architecture for real-time prevention:

┌───────────────────────────────────────────────────────────┐
│ Main Process │
│ (rusty_sand.exe) │
│ │
│ ┌─────────────┐ ┌──────────────┐ ┌──────────────┐ │
│ │ Process │ │ Monitoring │ │ Behavioral │ │
│ │ Controller │ │ Engine │ │ Analyzer │ │
│ └─────────────┘ └──────────────┘ └──────────────┘ │
│ │ │ │ │
│ └──────────────────┼───────────────────┘ │
│ │ │
│ ┌────────▼────────┐ │
│ │ IPC Server │ │
│ │ (Named Pipe) │ │
│ └────────┬────────┘ │
└─────────────────────────────┼─────────────────────────────┘
│
\\.\pipe\rusty_sand_hooks
│
┌─────────────────────────────▼──────────────────────────────┐
│ Target Process │
│ (suspended.exe) │
│ │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ rusty_sand_hooks.dll (injected) │ │
│ │ │ │
│ │ ┌─────────────┐ ┌──────────────┐ ┌───────────┐ │ │
│ │ │ CreateFileW│ │ connect() │ │RegSetValue│ │ │
│ │ │ Hook │ │ Hook │ │ Hook │ │ │
│ │ └─────────────┘ └──────────────┘ └───────────┘ │ │
│ │ │ │ │ │ │
│ │ └─────────────────┼────────────────┘ │ │
│ │ │ │ │
│ │ ┌────────▼────────┐ │ │
│ │ │ IPC Client │ │ │
│ │ │(request_approval) │ │
│ │ └─────────────────┘ │ │
│ └─────────────────────────────────────────────────────┘ │
│ │
│ Original Windows APIs (via MinHook trampolines) │
└────────────────────────────────────────────────────────────┘

Execution Flow

1. Initialization

   • Main process creates target in CREATE_SUSPENDED state
   • IPC server starts on named pipe \\.\pipe\rusty_sand_hooks
   • Hook DLL (rusty_sand_hooks.dll) injected via CreateRemoteThread
   • DLL connects to IPC server and installs MinHook hooks

2. Initial Approval

   • User prompted to allow initial execution
   • If approved: process resumes, hooks are active
   • If denied: process terminated immediately

3. Real-Time Interception

   • Target calls CreateFileW() → hook intercepts
   • Hook extracts parameters (file path, flags, attributes)
   • Hook sends HookRequest to main process via named pipe
   • Main process prompts user: Allow/Deny/Terminate
   • Response sent back to hook DLL
   • If allowed: call original API via trampoline
   • If denied: return error handle WITHOUT calling original API

4. Shutdown

   • Process exits (normally or terminated)
   • Shutdown signal sent to all monitoring tasks
   • 500ms grace period for cleanup
   • Report generated

Workspace Structure

This is a Cargo workspace with two crates:

• rusty_sand - Main executable (binary crate)
• rusty_sand_hooks - Hook DLL (cdylib crate) → compiles to rusty_sand_hooks.dll

Both must be built for full functionality. The DLL must be in the same directory as the executable.

---

🚀 Quick Start

Prerequisites

• Windows 10/11 (x64)
• Rust toolchain (1.70+)
• Administrator privileges (recommended for full functionality)

Installation

# Clone the repository
git clone https://github.com/yourusername/rusty_sand.git
cd rusty_sand
# Build both main executable AND hook DLL (REQUIRED)
cargo build --release --workspace
# Binaries will be at:# target\release\rusty_sand.exe# target\release\rusty_sand_hooks.dll (must be in same directory!)

Important: You must build the entire workspace. The hook DLL is required for API interception to work.

Basic Usage

# Run with interactive HIPS mode (default)
.\target\release\rusty_sand.exe suspicious.exe
# Run in passive monitoring mode (no prompts, post-execution analysis only)
.\target\release\rusty_sand.exe --no-interactive malware.exe
# Enable internet access (⚠️ use with extreme caution!)
.\target\release\rusty_sand.exe --internet suspicious.exe
# Custom timeout and memory limits
.\target\release\rusty_sand.exe -t 60 -m 512 program.exe
# Pass arguments to sandboxed program
.\target\release\rusty_sand.exe program.exe -- arg1 arg2 arg3
# Verbose debug output
.\target\release\rusty_sand.exe -v suspicious.exe
# Disable API hooks (passive monitoring only)
.\target\release\rusty_sand.exe --no-interactive suspicious.exe

---

📖 Command-Line Options

Required

• EXECUTABLE - Path to executable to sandbox (absolute or relative)

Optional Flags

• -i, --internet - Enable internet access (⚠️DEFAULT: DISABLED)
• -d, --dns - Enable DNS resolution
• -t, --timeout <SECONDS> - Execution timeout (default: 300)
• -m, --memory <MB> - Memory limit in MB (default: 1024)
• -w, --workdir <PATH> - Working directory for process
• -o, --output <DIR> - Output directory (default: ./sandbox_output)
• -f, --format <FORMAT> - Output format: console, json, both (default: both)
• -v, --verbose - Enable verbose debug output
• --log-network - Enable detailed network packet logging
• --no-registry - Disable registry monitoring
• --no-interactive - Disable HIPS mode (passive monitoring only)
• --no-behavior-detection - Disable behavioral threat detection

View Full Help

rusty_sand.exe --help

---

🎯 Interactive Mode (HIPS)

When running with API hooks enabled (default), Rusty Sand intercepts operations before execution and prompts in real-time with intelligent risk scoring:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
⚠️ INTERCEPTED OPERATION #5
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ACTION: CREATE REMOTE THREAD (Process Injection)
TARGET: explorer.exe (PID 1234)
DETAILS: Start address: 0x7FFE0000
RISK SCORE: 🔴 95/100 [CRITICAL]
🛑 BLOCKED - Waiting for your decision...
[Y]es / [A]llow All / [N]o / [D]eny All / [T]erminate >

Risk scores help you make informed decisions:

• 🟢 LOW (0-30): Safe to allow, normal operations
• 🟡 MEDIUM (31-60): Review carefully before allowing
• 🟠 HIGH (61-85): Suspicious, likely deny unless expected
• 🔴 CRITICAL (86-100): Almost certainly malicious, deny recommended

Decision Options

When an operation is intercepted:

• [Y]es - Allow this single operation (calls original API)
• [A]llow All - Auto-allow ALL future operations of this type (no more prompts)
• [N]o - Block this single operation (returns error to target)
• [D]eny All - Auto-block ALL future operations of this type (no more prompts)
• [T]erminate - Immediately kill the entire process

If you choose [N]o, you'll see a follow-up prompt:

 🚫 BLOCKED
[C]ontinue / [T]erminate >

• [C]ontinue - Continue monitoring the process
• [T]erminate - Kill the process immediately

---

📊 Report Example

Console Output

═══════════════════════════════════════════════════
SANDBOX EXECUTION REPORT
═══════════════════════════════════════════════════
📋 EXECUTION DETAILS
Executable: suspicious.exe
Start Time: 2025-10-10 14:30:00 UTC
End Time: 2025-10-10 14:32:15 UTC
Duration: 135 seconds
Exit Code: 0
🔐 SECURITY CONFIGURATION
Internet: DISABLED ✓
API Hooks: ENABLED (17 hooks active - +112% coverage) ✨
Risk Scoring: ENABLED (Real-time threat assessment) ✨
Interactive: ENABLED (HIPS mode)
Memory Limit: 1024 MB
📊 EVENT SUMMARY
Total Events: 68
File Operations: 12
Folder Operations: 3
Process Operations: 8 ✨
Memory Operations: 5 ✨
Network Blocked: 2 ⚠️
Registry Operations: 38
🚨 THREATS DETECTED (Risk Score)
[CRITICAL 95] Remote thread injection attempt in explorer.exe ✨
[CRITICAL 90] Registry persistence: HKLM\Run key modified
[HIGH 85] Cross-process memory write to svchost.exe ✨
[HIGH 75] RWX memory allocation (shellcode indicator) ✨
[MEDIUM 55] Suspicious folder creation in ProgramData
[MEDIUM 45] Attempted connection to C2 port 4444
📝 RECENT EVENTS (last 100)
📁 [14:30:05] FolderCreated: C:\ProgramData\Malware
📄 [14:30:08] FileCreated: C:\temp\output.txt
🌐 [14:30:12] NetworkBlocked: TCP 192.168.1.100:4444
...

JSON Report

Saved to sandbox_output/report.json with complete event details, timestamps, user decisions, and configuration.

---

🔧 Library Usage

Rusty Sand can be used as a Rust library:

use rusty_sand::{execute_sandboxed,SandboxConfig};use std::time::Duration;#[tokio::main]asyncfnmain() -> anyhow::Result<()>{letmut config = SandboxConfig::new().with_internet(false).with_timeout(Duration::from_secs(60)).with_memory_limit(512).with_verbose(true);// Enable API hooks for real-time prevention
config.enable_api_hooks = true;
config.interactive_mode = true;let report = execute_sandboxed("suspicious.exe",&["arg1".to_string(),"arg2".to_string()],
config
).await?;println!("Total events: {}", report.events.len());println!("Exit code: {}", report.exit_code);// Access specific event typeslet file_events = report.get_file_events();let network_events = report.get_network_events();// Analyze threatsfor event in report.events{if event.event_type == rusty_sand::report::EventType::FolderDeleted{println!("Folder deleted: {}", event.details);}}Ok(())}

See examples/basic_usage.rs and examples/advanced_monitoring.rs.

---

🔬 Detection Capabilities

Ransomware Detection

• Rapid file creation patterns (>50 files in short time)
• Suspicious file extensions (.encrypted, .locked, .crypto)
• Mass file deletion in user directories

Persistence Detection

• Registry Run key modifications (HKCU\Software\Microsoft\Windows\CurrentVersion\Run)
• Startup folder access
• Scheduled task creation
• Service installation

Folder-Based Threats (NEW)

• Suspicious folder creation in ProgramData (persistence)
• Hidden folder creation (names starting with .)
• Critical system folder deletion (System32, Program Files)
• User data folder deletion (Documents, Desktop, Downloads)

UAC Bypass Detection

• HKCU\Environment\windir manipulation
• ms-settings protocol abuse
• DLL hijacking patterns

Network Threats

• C2 server communication (ports 4444, 8080, 31337)
• Blocked connections when internet disabled
• Unusual connection patterns

---

⚙️ Component Architecture

Main Process Components

Component	File	Purpose
Process Controller	src/control/mod.rs	Suspend/resume threads via Toolhelp32
Interactive Controller	src/control/interactive.rs	HIPS prompts and user decisions
Monitoring Engine	src/monitor/mod.rs	Event collection, IPC server loop, risk analysis integration
File Monitor	src/monitor/filesystem.rs	Directory watching (notify crate)
Network Monitor	src/monitor/network.rs	TCP/UDP table polling
Process Monitor	src/monitor/process.rs	Process tree tracking
Risk Scorer ✨ NEW	src/analysis/risk_scorer.rs	Real-time threat scoring (0-100 scale)
Behavioral Analyzer	src/behavior/mod.rs	Threat pattern detection
Sandbox	src/sandbox/process.rs	Job objects, process creation
IPC Protocol	src/ipc/mod.rs	Named pipe communication
DLL Injection	src/injection/mod.rs	DLL injection via remote thread

Hook DLL Components (Modular Architecture ✨ NEW)

Component	File	Purpose
Hook DLL Entry Point	rusty_sand_hooks/src/lib.rs	DLL initialization and MinHook orchestration
File Hooks	rusty_sand_hooks/src/hooks/file_hooks.rs	CreateFileW, DeleteFileW interception
Folder Hooks	rusty_sand_hooks/src/hooks/folder_hooks.rs	CreateDirectoryW, RemoveDirectoryW interception
Network Hooks	rusty_sand_hooks/src/hooks/network_hooks.rs	connect interception
Registry Hooks	rusty_sand_hooks/src/hooks/registry_hooks.rs	Registry operation interception (4 hooks)
Process Hooks ✨ NEW	rusty_sand_hooks/src/hooks/process_hooks.rs	Process/thread creation interception (3 hooks)
Memory Hooks ✨ NEW	rusty_sand_hooks/src/hooks/memory_hooks.rs	Memory/DLL operation interception (5 hooks)
IPC Types	rusty_sand_hooks/src/types.rs	Enhanced operation types with rich metadata
IPC Client	rusty_sand_hooks/src/ipc_client.rs	Named pipe communication layer
Registry Utils	rusty_sand_hooks/src/registry_utils.rs	HKEY-to-string conversion utilities
Logging System ✨ NEW	rusty_sand_hooks/src/logging.rs	Professional file-based logging with hook_log!() macro

Hooked Functions (17 total - +112% increase):

• File Operations (2): CreateFileW, DeleteFileW
• Folder Operations (2): CreateDirectoryW, RemoveDirectoryW
• Network Operations (1): connect
• Registry Operations (4): RegSetValueExW, RegDeleteKeyW, RegQueryValueExW, RegOpenKeyExW
• Process/Thread Operations (3) ✨ NEW: CreateProcessW, CreateThread, CreateRemoteThread
• Memory/DLL Operations (5) ✨ NEW: VirtualAlloc, VirtualProtect, WriteProcessMemory, LoadLibraryW, LoadLibraryExW

---

🛠️ Development

Building from Source

# Build main executable only
cargo build --release
# Build hook DLL only
cargo build --release --package rusty_sand_hooks
# Build entire workspace (recommended)
cargo build --release --workspace
# Debug build (faster compilation)
cargo build --workspace
# Check code without building
cargo check --workspace
# Run clippy linter
cargo clippy --workspace -- -D warnings
# Format code
cargo fmt --all

Project Structure

rusty_sand/
├── src/ # Main executable crate
│ ├── analysis/ # Risk scoring system ✨ NEW
│ │ ├── mod.rs
│ │ └── risk_scorer.rs # 0-100 threat scoring
│ ├── behavior/ # Threat detection engine
│ ├── control/ # Process control & HIPS
│ ├── monitor/ # Monitoring subsystems
│ ├── report/ # Reporting and output
│ ├── sandbox/ # Process isolation
│ ├── ipc/ # Named pipe IPC
│ ├── injection/ # DLL injection
│ ├── config.rs # Configuration
│ ├── lib.rs # Library entry point
│ └── main.rs # CLI entry point
├── rusty_sand_hooks/ # Hook DLL crate (modular architecture ✨ NEW)
│ ├── src/
│ │ ├── hooks/ # Organized by category ✨ NEW
│ │ │ ├── file_hooks.rs
│ │ │ ├── folder_hooks.rs
│ │ │ ├── network_hooks.rs
│ │ │ ├── registry_hooks.rs
│ │ │ ├── process_hooks.rs ✨ NEW
│ │ │ └── memory_hooks.rs ✨ NEW
│ │ ├── types.rs # Enhanced IPC types ✨ NEW
│ │ ├── ipc_client.rs # IPC communication ✨ NEW
│ │ ├── registry_utils.rs # HKEY utilities ✨ NEW
│ │ ├── logging.rs # Professional logging ✨ NEW
│ │ ├── utils.rs # Common utilities ✨ NEW
│ │ └── lib.rs # DLL entry point (refactored)
│ └── Cargo.toml # DLL dependencies
├── examples/ # Usage examples
├── Cargo.toml # Workspace config
├── EXECUTION_FLOW.md # Architecture documentation
└── README.md

Running Examples

cargo run --release --example basic_usage
cargo run --release --example advanced_monitoring

---

✨ Recent Major Improvements

Version 2.0 - Intelligence & Modularity Update

🎯 Real-Time Risk Scoring System

• Intelligent 0-100 threat assessment for every intercepted operation
• Four-tier categorization (Low/Medium/High/Critical) with color-coded display
• Context-aware scoring considering operation type, target, and parameters
• Smart filtering auto-allows read-only operations (60% reduction in prompt fatigue)

🛡️ Expanded API Coverage (+112%)

• 17 hooked APIs (up from 8) - comprehensive protection coverage
• Process/Thread hooks: Detect process injection, remote thread creation
• Memory/DLL hooks: Catch RWX allocations, DEP bypasses, code injection
• Enhanced file/folder/registry/network interception with rich metadata

🏗️ Professional Modular Architecture

• Hook DLL refactored from 809-line monolith to organized module system
• Category-based organization (file, folder, network, registry, process, memory)
• Clean separation of concerns for maintainability
• File-based logging system with configurable levels and timestamps

🔍 Enhanced Detection Capabilities

• Process Injection Detection: CreateRemoteThread, cross-process memory writes
• Code Execution Detection: RWX memory allocations, memory protection changes
• DLL Injection Detection: Suspicious library loading patterns
• Advanced Persistence: Comprehensive startup and autorun detection
• Living-off-the-Land: PowerShell abuse, LOLBAS detection

📊 Improved User Experience

• Risk scores displayed in real-time prompts with emoji indicators (🟢🟡🟠🔴)
• Human-readable registry paths (HKLM\Software\... instead of raw pointers)
• Comprehensive operation metadata (access rights, share modes, protection flags)
• Professional logging for debugging hook DLL behavior

---

⚠️ Limitations

• Windows Only: Uses Win32 APIs exclusively (Job Objects, Toolhelp32, Named Pipes)
• User-Mode: Cannot intercept kernel-level operations or drivers
• Evasion: Sophisticated malware can detect hooks (MinHook inline hooking)
• Performance: HIPS mode significantly slows execution due to user prompts
• Admin Privileges: Some features require elevation
• Hook DLL Dependency: API interception requires successful DLL injection

---

🤝 Contributing

Contributions welcome for:

• Additional API hooks (WriteFile, NtCreateFile, GetProcAddress, etc.)
• Enhanced risk scoring algorithms and detection patterns
• Behavioral detection rules (YARA-style, MITRE ATT&CK mapping)
• Performance optimizations (async hook handling, caching)
• Better Windows API integration (kernel callbacks, ETW tracing)
• Machine learning integration for risk scoring
• Bug fixes and stability improvements
• Documentation and examples

Please ensure all contributions are for defensive security purposes only.

---

📝 License

MIT License - See LICENSE file for details.

For defensive security research only. The authors are not responsible for misuse.

---

👥 Authors

• GuestAUser - Creator and primary developer

🙏 Acknowledgments

• MinHook - x86/x64 API hooking library
• Windows API documentation and community
• Rust security community
• Malware analysis research community
• Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software 1st Edition by Michael Sikorski (Author), Andrew Honig (Author)

---

📚 Related Projects

• Cuckoo Sandbox - Automated malware analysis
• CAPE Sandbox - Advanced malware analysis
• Sandboxie - Application sandboxing
• Any.Run - Interactive malware analysis service

---

Stay safe and sandbox everything! 🏖️