You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
All notable changes to RedSand are documented here. Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Note: the artifacts here are Windows Sandbox configs and PowerShell scripts rather than a versioned API, so semver is followed loosely — minor version bumps reflect meaningful additions to the user-facing surface.
4
+
5
+
## [2.0]
6
+
7
+
### Added
8
+
-**Profiles** — `profiles/RedSand-Analysis.wsb` (max-isolation RE / dynamic + static analysis) and `profiles/RedSand-Forensics.wsb` (evidence triage), alongside the existing default. Both default to network off, audio/video/printer/clipboard disabled, ProtectedClient on, and read-only `Input/` + read-write `Output/` host mappings. `profiles/RedSand-Pentest.wsb` is stashed in `.drafts/` pending demand.
9
+
-**`Input/` (read-only)** and **`Output/` (read-write)** host directories. Mapped by Analysis and Forensics profiles; the `Output/``MappedFolder` block in each wsb is marked for trivial removal if you want zero writable host mappings.
-**`prepareForRedSand.ps1`** — host-side orchestrator. Checks the sandbox feature is enabled, then runs the OnHost downloader scripts (interactive prompt, or `-All` / `-Sysinternals` / `-Zimmerman` flags).
15
+
16
+
### Changed
17
+
- Default `RedSand.wsb` moved from repo root to `profiles/RedSand.wsb`. Mapped folder paths updated to `..\Utils\` / `..\Files\`.
- README rewritten from the GitHub wiki contents, with CI badge and threat-model / WSL caveats section.
27
+
28
+
### Changed
29
+
-`installREToolkit.ps1` no longer pins the `2022.04` release — fetches latest from the GitHub releases API and handles the `.7z`-wrapped installer introduced in `2026.04`.
30
+
- OnHost downloader scripts anchor paths with `$PSScriptRoot` so they work regardless of caller PWD.
31
+
-`installChocoAndScoop.ps1` passes `-RunAsAdmin` to Scoop (required since the sandbox runs as admin) and verifies install via on-disk file existence rather than PATH.
32
+
- All PowerShell scripts declare `#Requires -Version 5.1` and set `$ErrorActionPreference = 'Stop'`.
33
+
- README footer correctly identifies the license as ISC (was mislabeled MIT briefly).
34
+
35
+
### Fixed
36
+
- Scoop install silently failed inside the admin sandbox — now correctly invoked with `-RunAsAdmin`.
37
+
-`Expand-Archive` re-run failures in OnHost downloaders (added `-Force`).
38
+
39
+
## [1.0] — 2022-08-18
40
+
41
+
### Added
42
+
- Initial `RedSand.wsb` sandbox config with mapped `Utils/` (read-only) and `Files/` (read-write) folders.
43
+
-`setup.ps1` — runs on logon: dark theme, dev mode unlock, RedSand wallpaper, ExecutionPolicy unrestricted.
44
+
- OnHost downloaders for the Sysinternals Suite and Eric Zimmerman's forensics tools.
45
+
-`enableSandboxFeature.ps1` host helper.
46
+
- In-sandbox scripts: `godMode.ps1`, `customScript.ps1`, `installChocoAndScoop.ps1`, `installREToolkit.ps1` (pinned to retoolkit 2022.04 at the time).
Copy file name to clipboardExpand all lines: README.md
+75-29Lines changed: 75 additions & 29 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,10 +8,18 @@
8
8
9
9
## About
10
10
11
-
RedSand is a pre-made `.wsb` that spins up a Windows Sandbox tailored for security work — just double-click the file. It maps a read-only `Utils/` folder (scripts, toolkits) and a read-write `Files/` folder (your working files) into the VM, then runs a setup script on logon.
11
+
RedSand is a set of pre-made `.wsb`profiles that spin up a Windows Sandbox tailored for security work — just double-click one. Each profile maps a read-only `Utils/` folder (scripts, toolkits) plus the host folders appropriate for its workflow, then runs a setup script on logon.
12
12
13
13
Modify the `.wsb` and `.ps1` files freely to match your workflow. Contributions of all kinds — new scripts, `.wsb` tweaks, documentation — are welcome.
14
14
15
+
## Gallery
16
+
17
+
<palign="center">
18
+
<imgsrc="media/01-boot.png"alt="Sandbox boot screen with dark theme and RedSand wallpaper"width="60%" />
19
+
</p>
20
+
21
+
<palign="center"><sub><i>Post-logon boot — dark theme and RedSand wallpaper applied by setup.ps1.</i></sub></p>
22
+
15
23
## Quick start
16
24
17
25
1. Enable the Windows Sandbox feature (one-time, requires Windows 10/11 Pro / Enterprise / Education):
@@ -20,73 +28,109 @@ Modify the `.wsb` and `.ps1` files freely to match your workflow. Contributions
2.Pick a profile from `profiles/` and double-click it. Start with `profiles\RedSand.wsb`if unsure.
24
32
3. The sandbox boots, `setup.ps1` runs automatically, and you land on a desktop ready to work.
25
33
26
-
## What you get
34
+
**Tip:** For first-time setup, `Utils\Scripts\AdditionalScripts\OnHost\prepareForRedSand.ps1` orchestrates step 1 (feature check) and pre-stages tools in `Utils/Toolkits/` so the strict profiles have something to work with — interactive picker, or pass `-All` to grab everything.
35
+
36
+
## Profiles
37
+
38
+
Pick the profile that matches your workflow. All profiles share the same `setup.ps1` (dark theme, dev mode, wallpaper, ExecutionPolicy) — they differ in sandbox isolation knobs and which host folders are mapped.
-**Default** — general-purpose; `Files/` is read-write scratch space.
57
+
-**Analysis** — drop samples into `Input/`*before launch* (it's read-only inside, so the sample can't tamper with the original or delete itself). Analysis artifacts land in `Output/`. The wsb has commented-out auto-run hints for: Defender disable, lightweight tool pack, and REtoolkit — uncomment what you need. Tool installs require network on first boot.
58
+
-**Forensics** — drop evidence images into `Input/`*before launch*. Notes/exports land in `Output/`. Same isolation as Analysis but vGPU stays on for image-viewer responsiveness. Commented hints for Defender disable and a narrow forensics tool pack are in the wsb.
27
59
28
-
The default `RedSand.wsb`enables a hardened baseline suitable for analysis work:
60
+
Each profile's `.wsb`has the `Output/` mapping clearly marked — comment that `MappedFolder` block out if you want a sandbox with zero writable host mappings.
29
61
30
-
| Setting | Value | Why |
31
-
|---|---|---|
32
-
|`ProtectedClient`| Enable | Stricter RDP security inside the sandbox |
33
-
|`ClipboardRedirection`| Disable | Host clipboard can't leak into / out of the VM |
34
-
|`MemoryInMB`| 4096 | Comfortable for most tooling |
35
-
|`Networking`| Default | Internet on — adjust to taste |
62
+
**If you pick a network-off profile (Analysis / Forensics), run the on-host downloader scripts first** so the tools you need are pre-staged in `Utils/Toolkits/` before launch — once the sandbox boots there's no way to fetch them.
36
63
37
-
On logon, `setup.ps1`also:
64
+
What `setup.ps1`does on every profile:
38
65
39
66
- Sets ExecutionPolicy to `Unrestricted` (sandbox-local, throwaway)
├── Output/ # Read-write results dir (Analysis + Forensics)
82
+
└── Utils/
83
+
├── Toolkits/ # Tools downloaded by OnHost scripts land here
84
+
└── Scripts/
85
+
├── DefaultScripts/ # Run automatically on logon (every profile)
86
+
│ └── setup.ps1
87
+
└── AdditionalScripts/
88
+
├── OnHost/ # Run these on your host before launching
89
+
└── InSandbox/ # Run these inside the sandbox (manual or via wsb)
61
90
```
62
91
63
-
`Utils/` is mapped read-only;`Files/` read-write. Anything you download on the host into `Utils/Toolkits/` (via the OnHost scripts) becomes available inside the sandbox at `C:\users\WDAGUtilityAccount\Desktop\Utils\Toolkits\`.
92
+
`Utils/` is always mapped read-only.`Files/`is mapped read-write only by the default profile. `Input/` is mapped read-only by Analysis and Forensics; `Output/` is mapped read-write by the same two. Anything you download on the host into `Utils/Toolkits/` (via the OnHost scripts) becomes available inside the sandbox at `C:\users\WDAGUtilityAccount\Desktop\Utils\Toolkits\`.
64
93
65
94
## Scripts reference
66
95
67
96
### On-host (run before launching the sandbox, from your normal Windows session)
68
97
69
98
| Script | What it does |
70
99
|---|---|
100
+
|`prepareForRedSand.ps1`| One-shot orchestrator. Checks the sandbox feature is enabled, then runs the downloader scripts below (interactive picker, or `-All` / `-Sysinternals` / `-Zimmerman` flags). |
71
101
|`enableSandboxFeature.ps1`| Enables the Windows Sandbox optional feature. Requires admin; may need a reboot. |
72
102
|`downloadSysinternalsSuite.ps1`| Downloads SysinternalsSuite into `Utils/Toolkits/SysinternalsSuite/`. |
73
103
|`downloadZimmermanTools.ps1`| Fetches Eric Zimmerman's forensics tools into `Utils/Toolkits/Zimmerman/`. |
74
104
75
-
### In-sandbox (run inside the VM, manually or by wiring into `RedSand.wsb`)
105
+
To run any OnHost script, open PowerShell in the repo root:
`prepareForRedSand.ps1` is the recommended starting point for first-time setup.
112
+
113
+
### In-sandbox (run inside the VM, manually or by wiring into a profile's `.wsb`)
76
114
77
115
| Script | What it does |
78
116
|---|---|
79
-
|`installChocoAndScoop.ps1`| Installs both [Scoop](https://scoop.sh) and [Chocolatey](https://chocolatey.org). |
117
+
|`installChocoAndScoop.ps1`| Installs both [Scoop](https://scoop.sh) and [Chocolatey](https://chocolatey.org). Prerequisite for the tool-pack installers below. |
118
+
|`installAnalysisTools.ps1`| Lightweight RE pack via scoop: dnSpy, HxD, PE-bear, Detect It Easy, x64dbg, System Informer (formerly Process Hacker), Wireshark. |
119
+
|`installForensicsTools.ps1`| Narrow forensics pack via scoop: HxD, ExifTool (complements pre-staged Sysinternals + EZ tools). |
80
120
|`installREToolkit.ps1`| Downloads the latest [REtoolkit](https://github.com/mentebinaria/retoolkit) release and runs the silent installer. |
121
+
|`disableDefender.ps1`| Disables Defender **inside the sandbox only** (host untouched). Use when samples would otherwise be quarantined. |
122
+
|`excludeInputFromDefender.ps1`| Softer alternative — keeps Defender running but adds `Input/` to its exclusion list. |
81
123
|`godMode.ps1`| Creates a "God Mode" control-panel folder on the desktop. |
82
124
|`customScript.ps1`| Empty hook — drop whatever you want auto-run here. |
83
125
84
-
To auto-run any in-sandbox script on logon, uncomment the matching line in `RedSand.wsb`:
126
+
To auto-run any in-sandbox script on logon, uncomment the matching line in your chosen profile's `.wsb`:
> NOTE: if you want to use any script that requires network connectivity (`installREToolkit.ps1` OR `installChocoAndScoop.ps1` and dependent on it `installAnalysisTools.ps1`/`installForensicsTools.ps1`) in 'Analysis' or 'Forensics' profile - please toggle `<Networking>Default</Networking>` in respective `.wsb` file.
133
+
90
134
## Customization
91
135
92
136
The `.wsb` schema is documented by Microsoft: [Windows Sandbox configuration](https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file).
@@ -98,7 +142,9 @@ Common tweaks:
98
142
-**GPU passthrough** — already `Default`; change to `Disable` if you want strict CPU-only execution
99
143
-**Extra logon commands** — add more `<Command>` entries in `<LogonCommand>`
100
144
101
-
For one-off in-sandbox setup, edit `customScript.ps1` and uncomment its `<Command>` line in the wsb — keeps your customizations out of the always-run `setup.ps1`.
145
+
For one-off in-sandbox setup, edit `customScript.ps1` and uncomment its `<Command>` line in your profile's wsb — keeps your customizations out of the always-run `setup.ps1`.
146
+
147
+
If you don't want a profile's writable `Output/` mapping persisting state on the host, comment out the `Output/``MappedFolder` block in that wsb (it's marked with an inline comment).
0 commit comments