Skip to content

Commit 57e3349

Browse files
committed
introduce basic profiles
1 parent d5028b7 commit 57e3349

21 files changed

Lines changed: 531 additions & 61 deletions

.github/workflows/ci.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
lint-and-validate:
1010
runs-on: ubuntu-latest
1111
steps:
12-
- uses: actions/checkout@v6
12+
- uses: actions/checkout@v4
1313

1414
- name: Install PSScriptAnalyzer
1515
shell: pwsh

.github/workflows/url-liveness.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
check-urls:
1414
runs-on: ubuntu-latest
1515
steps:
16-
- uses: actions/checkout@v6
16+
- uses: actions/checkout@v4
1717

1818
- name: Probe upstream URLs
1919
shell: pwsh
@@ -23,7 +23,8 @@ jobs:
2323
'https://chocolatey.org/install.ps1',
2424
'https://www.7-zip.org/a/7zr.exe',
2525
'https://download.sysinternals.com/files/SysinternalsSuite.zip',
26-
'https://f001.backblazeb2.com/file/EricZimmermanTools/Get-ZimmermanTools.zip'
26+
'https://raw.githubusercontent.com/EricZimmerman/Get-ZimmermanTools/master/Get-ZimmermanTools.ps1',
27+
'https://tools.ericzimmermanstools.com'
2728
)
2829
2930
function Test-Url {

.gitignore

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,16 @@
1+
.DS_Store
2+
13
Utils/Toolkits/*
24
!Utils/Toolkits/.gitkeep
35

46
Files/*
57
!Files/.gitkeep
68

7-
# Work-in-progress profiles + their outputs — not yet released
9+
Input/*
10+
!Input/.gitkeep
11+
12+
Output/*
13+
!Output/.gitkeep
14+
15+
# Work-in-progress profiles — not yet released
816
.drafts/

CHANGELOG.md

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Changelog
2+
3+
All notable changes to RedSand are documented here. Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Note: the artifacts here are Windows Sandbox configs and PowerShell scripts rather than a versioned API, so semver is followed loosely — minor version bumps reflect meaningful additions to the user-facing surface.
4+
5+
## [2.0]
6+
7+
### Added
8+
- **Profiles**`profiles/RedSand-Analysis.wsb` (max-isolation RE / dynamic + static analysis) and `profiles/RedSand-Forensics.wsb` (evidence triage), alongside the existing default. Both default to network off, audio/video/printer/clipboard disabled, ProtectedClient on, and read-only `Input/` + read-write `Output/` host mappings. `profiles/RedSand-Pentest.wsb` is stashed in `.drafts/` pending demand.
9+
- **`Input/` (read-only)** and **`Output/` (read-write)** host directories. Mapped by Analysis and Forensics profiles; the `Output/` `MappedFolder` block in each wsb is marked for trivial removal if you want zero writable host mappings.
10+
- **`disableDefender.ps1`** — disables sandbox-local Defender (host untouched). Tamper-Protection aware.
11+
- **`excludeInputFromDefender.ps1`** — softer alternative; whitelists `Input/` only.
12+
- **`installAnalysisTools.ps1`** — lightweight scoop pack: HxD, dnSpy, PE-bear, Detect It Easy, x64dbg, System Informer, Wireshark.
13+
- **`installForensicsTools.ps1`** — narrow scoop pack: HxD, ExifTool.
14+
- **`prepareForRedSand.ps1`** — host-side orchestrator. Checks the sandbox feature is enabled, then runs the OnHost downloader scripts (interactive prompt, or `-All` / `-Sysinternals` / `-Zimmerman` flags).
15+
16+
### Changed
17+
- Default `RedSand.wsb` moved from repo root to `profiles/RedSand.wsb`. Mapped folder paths updated to `..\Utils\` / `..\Files\`.
18+
19+
## [1.1] — 2026-05-17
20+
21+
### Added
22+
- Project hygiene: `CONTRIBUTING.md`, `SECURITY.md`, issue/PR templates, Dependabot for GitHub Actions.
23+
- CI: PSScriptAnalyzer linting, PowerShell syntax parsing, and `.wsb` XML validation (`.github/workflows/ci.yml`).
24+
- Weekly URL liveness check for upstream installer URLs (`.github/workflows/url-liveness.yml`).
25+
- `.wsb` hardening defaults: `ProtectedClient` enabled, `ClipboardRedirection` disabled, explicit `MemoryInMB`.
26+
- README rewritten from the GitHub wiki contents, with CI badge and threat-model / WSL caveats section.
27+
28+
### Changed
29+
- `installREToolkit.ps1` no longer pins the `2022.04` release — fetches latest from the GitHub releases API and handles the `.7z`-wrapped installer introduced in `2026.04`.
30+
- OnHost downloader scripts anchor paths with `$PSScriptRoot` so they work regardless of caller PWD.
31+
- `installChocoAndScoop.ps1` passes `-RunAsAdmin` to Scoop (required since the sandbox runs as admin) and verifies install via on-disk file existence rather than PATH.
32+
- All PowerShell scripts declare `#Requires -Version 5.1` and set `$ErrorActionPreference = 'Stop'`.
33+
- README footer correctly identifies the license as ISC (was mislabeled MIT briefly).
34+
35+
### Fixed
36+
- Scoop install silently failed inside the admin sandbox — now correctly invoked with `-RunAsAdmin`.
37+
- `Expand-Archive` re-run failures in OnHost downloaders (added `-Force`).
38+
39+
## [1.0] — 2022-08-18
40+
41+
### Added
42+
- Initial `RedSand.wsb` sandbox config with mapped `Utils/` (read-only) and `Files/` (read-write) folders.
43+
- `setup.ps1` — runs on logon: dark theme, dev mode unlock, RedSand wallpaper, ExecutionPolicy unrestricted.
44+
- OnHost downloaders for the Sysinternals Suite and Eric Zimmerman's forensics tools.
45+
- `enableSandboxFeature.ps1` host helper.
46+
- In-sandbox scripts: `godMode.ps1`, `customScript.ps1`, `installChocoAndScoop.ps1`, `installREToolkit.ps1` (pinned to retoolkit 2022.04 at the time).
47+
- ISC license.
48+
49+
[Unreleased]: https://github.com/redcode-labs/RedSand/compare/v.1.1...HEAD
50+
[1.1.0]: https://github.com/redcode-labs/RedSand/compare/v.1.0...v.1.1
51+
[1.0.0]: https://github.com/redcode-labs/RedSand/releases/tag/v.1.0

Input/.gitkeep

Whitespace-only changes.

Output/.gitkeep

Whitespace-only changes.

README.md

Lines changed: 75 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,18 @@
88

99
## About
1010

11-
RedSand is a pre-made `.wsb` that spins up a Windows Sandbox tailored for security work — just double-click the file. It maps a read-only `Utils/` folder (scripts, toolkits) and a read-write `Files/` folder (your working files) into the VM, then runs a setup script on logon.
11+
RedSand is a set of pre-made `.wsb` profiles that spin up a Windows Sandbox tailored for security work — just double-click one. Each profile maps a read-only `Utils/` folder (scripts, toolkits) plus the host folders appropriate for its workflow, then runs a setup script on logon.
1212

1313
Modify the `.wsb` and `.ps1` files freely to match your workflow. Contributions of all kinds — new scripts, `.wsb` tweaks, documentation — are welcome.
1414

15+
## Gallery
16+
17+
<p align="center">
18+
<img src="media/01-boot.png" alt="Sandbox boot screen with dark theme and RedSand wallpaper" width="60%" />
19+
</p>
20+
21+
<p align="center"><sub><i>Post-logon boot — dark theme and RedSand wallpaper applied by setup.ps1.</i></sub></p>
22+
1523
## Quick start
1624

1725
1. Enable the Windows Sandbox feature (one-time, requires Windows 10/11 Pro / Enterprise / Education):
@@ -20,73 +28,109 @@ Modify the `.wsb` and `.ps1` files freely to match your workflow. Contributions
2028
.\Utils\Scripts\AdditionalScripts\OnHost\enableSandboxFeature.ps1
2129
```
2230
Reboot if prompted.
23-
2. Double-click `profiles\RedSand.wsb` in File Explorer.
31+
2. Pick a profile from `profiles/` and double-click it. Start with `profiles\RedSand.wsb` if unsure.
2432
3. The sandbox boots, `setup.ps1` runs automatically, and you land on a desktop ready to work.
2533

26-
## What you get
34+
**Tip:** For first-time setup, `Utils\Scripts\AdditionalScripts\OnHost\prepareForRedSand.ps1` orchestrates step 1 (feature check) and pre-stages tools in `Utils/Toolkits/` so the strict profiles have something to work with — interactive picker, or pass `-All` to grab everything.
35+
36+
## Profiles
37+
38+
Pick the profile that matches your workflow. All profiles share the same `setup.ps1` (dark theme, dev mode, wallpaper, ExecutionPolicy) — they differ in sandbox isolation knobs and which host folders are mapped.
39+
40+
| Setting | `RedSand.wsb` (default) | `RedSand-Analysis.wsb` | `RedSand-Forensics.wsb` |
41+
|---|---|---|---|
42+
| **Audience** | General-purpose | RE / static + dynamic binary analysis | Triaging evidence images |
43+
| `Networking` | Default | **Disable** | **Disable** |
44+
| `ClipboardRedirection` | Disable | Disable | Disable |
45+
| `ProtectedClient` | Enable | Enable | Enable |
46+
| `AudioInput` | Default | **Disable** | **Disable** |
47+
| `VideoInput` | Default | **Disable** | **Disable** |
48+
| `PrinterRedirection` | Default | **Disable** | **Disable** |
49+
| `VGpu` | Default | **Disable** | Default |
50+
| `MemoryInMB` | 4096 | 4096 | **8192** |
51+
| `Files/` mapping | read-write |||
52+
| `Input/` mapping || **read-only** | **read-only** |
53+
| `Output/` mapping || **read-write** | **read-write** |
54+
| `Utils/` mapping | read-only | read-only | read-only |
55+
56+
- **Default** — general-purpose; `Files/` is read-write scratch space.
57+
- **Analysis** — drop samples into `Input/` *before launch* (it's read-only inside, so the sample can't tamper with the original or delete itself). Analysis artifacts land in `Output/`. The wsb has commented-out auto-run hints for: Defender disable, lightweight tool pack, and REtoolkit — uncomment what you need. Tool installs require network on first boot.
58+
- **Forensics** — drop evidence images into `Input/` *before launch*. Notes/exports land in `Output/`. Same isolation as Analysis but vGPU stays on for image-viewer responsiveness. Commented hints for Defender disable and a narrow forensics tool pack are in the wsb.
2759

28-
The default `RedSand.wsb` enables a hardened baseline suitable for analysis work:
60+
Each profile's `.wsb` has the `Output/` mapping clearly marked — comment that `MappedFolder` block out if you want a sandbox with zero writable host mappings.
2961

30-
| Setting | Value | Why |
31-
|---|---|---|
32-
| `ProtectedClient` | Enable | Stricter RDP security inside the sandbox |
33-
| `ClipboardRedirection` | Disable | Host clipboard can't leak into / out of the VM |
34-
| `MemoryInMB` | 4096 | Comfortable for most tooling |
35-
| `Networking` | Default | Internet on — adjust to taste |
62+
**If you pick a network-off profile (Analysis / Forensics), run the on-host downloader scripts first** so the tools you need are pre-staged in `Utils/Toolkits/` before launch — once the sandbox boots there's no way to fetch them.
3663

37-
On logon, `setup.ps1` also:
64+
What `setup.ps1` does on every profile:
3865

3966
- Sets ExecutionPolicy to `Unrestricted` (sandbox-local, throwaway)
4067
- Enables developer mode (`AllowDevelopmentWithoutDevLicense`)
4168
- Switches to dark theme
4269
- Applies the RedSand wallpaper
4370

44-
Loosen the wsb defaults if your workload needs the host clipboard or more RAM.
45-
4671
## Directory layout
4772

4873
```
4974
RedSand/
50-
├── profiles/
51-
│ └── RedSand.wsb # Sandbox config — double-click to launch
52-
├── Files/ # Read-write; drop samples / payloads here
53-
├── Utils/
54-
│ ├── Toolkits/ # Tools downloaded by OnHost scripts land here
55-
│ └── Scripts/
56-
│ ├── DefaultScripts/ # Run automatically on logon
57-
│ │ └── setup.ps1
58-
│ └── AdditionalScripts/
59-
│ ├── OnHost/ # Run these on your host before launching
60-
│ └── InSandbox/ # Run these inside the sandbox (manual or via wsb)
75+
├── profiles/ # Sandbox configs — double-click one to launch
76+
│ ├── RedSand.wsb # Default
77+
│ ├── RedSand-Analysis.wsb # No network, max isolation, read-only Input/
78+
│ └── RedSand-Forensics.wsb # No network, 8 GB, read-only Input/
79+
├── Files/ # Read-write scratch (default profile only)
80+
├── Input/ # Read-only sample / evidence drop (Analysis + Forensics)
81+
├── Output/ # Read-write results dir (Analysis + Forensics)
82+
└── Utils/
83+
├── Toolkits/ # Tools downloaded by OnHost scripts land here
84+
└── Scripts/
85+
├── DefaultScripts/ # Run automatically on logon (every profile)
86+
│ └── setup.ps1
87+
└── AdditionalScripts/
88+
├── OnHost/ # Run these on your host before launching
89+
└── InSandbox/ # Run these inside the sandbox (manual or via wsb)
6190
```
6291

63-
`Utils/` is mapped read-only; `Files/` read-write. Anything you download on the host into `Utils/Toolkits/` (via the OnHost scripts) becomes available inside the sandbox at `C:\users\WDAGUtilityAccount\Desktop\Utils\Toolkits\`.
92+
`Utils/` is always mapped read-only. `Files/` is mapped read-write only by the default profile. `Input/` is mapped read-only by Analysis and Forensics; `Output/` is mapped read-write by the same two. Anything you download on the host into `Utils/Toolkits/` (via the OnHost scripts) becomes available inside the sandbox at `C:\users\WDAGUtilityAccount\Desktop\Utils\Toolkits\`.
6493

6594
## Scripts reference
6695

6796
### On-host (run before launching the sandbox, from your normal Windows session)
6897

6998
| Script | What it does |
7099
|---|---|
100+
| `prepareForRedSand.ps1` | One-shot orchestrator. Checks the sandbox feature is enabled, then runs the downloader scripts below (interactive picker, or `-All` / `-Sysinternals` / `-Zimmerman` flags). |
71101
| `enableSandboxFeature.ps1` | Enables the Windows Sandbox optional feature. Requires admin; may need a reboot. |
72102
| `downloadSysinternalsSuite.ps1` | Downloads SysinternalsSuite into `Utils/Toolkits/SysinternalsSuite/`. |
73103
| `downloadZimmermanTools.ps1` | Fetches Eric Zimmerman's forensics tools into `Utils/Toolkits/Zimmerman/`. |
74104

75-
### In-sandbox (run inside the VM, manually or by wiring into `RedSand.wsb`)
105+
To run any OnHost script, open PowerShell in the repo root:
106+
107+
```powershell
108+
powershell.exe -ExecutionPolicy Bypass -File .\Utils\Scripts\AdditionalScripts\OnHost\<script-name>.ps1
109+
```
110+
111+
`prepareForRedSand.ps1` is the recommended starting point for first-time setup.
112+
113+
### In-sandbox (run inside the VM, manually or by wiring into a profile's `.wsb`)
76114

77115
| Script | What it does |
78116
|---|---|
79-
| `installChocoAndScoop.ps1` | Installs both [Scoop](https://scoop.sh) and [Chocolatey](https://chocolatey.org). |
117+
| `installChocoAndScoop.ps1` | Installs both [Scoop](https://scoop.sh) and [Chocolatey](https://chocolatey.org). Prerequisite for the tool-pack installers below. |
118+
| `installAnalysisTools.ps1` | Lightweight RE pack via scoop: dnSpy, HxD, PE-bear, Detect It Easy, x64dbg, System Informer (formerly Process Hacker), Wireshark. |
119+
| `installForensicsTools.ps1` | Narrow forensics pack via scoop: HxD, ExifTool (complements pre-staged Sysinternals + EZ tools). |
80120
| `installREToolkit.ps1` | Downloads the latest [REtoolkit](https://github.com/mentebinaria/retoolkit) release and runs the silent installer. |
121+
| `disableDefender.ps1` | Disables Defender **inside the sandbox only** (host untouched). Use when samples would otherwise be quarantined. |
122+
| `excludeInputFromDefender.ps1` | Softer alternative — keeps Defender running but adds `Input/` to its exclusion list. |
81123
| `godMode.ps1` | Creates a "God Mode" control-panel folder on the desktop. |
82124
| `customScript.ps1` | Empty hook — drop whatever you want auto-run here. |
83125

84-
To auto-run any in-sandbox script on logon, uncomment the matching line in `RedSand.wsb`:
126+
To auto-run any in-sandbox script on logon, uncomment the matching line in your chosen profile's `.wsb`:
85127

86128
```xml
87129
<Command>powershell.exe -ExecutionPolicy Bypass -File C:\users\WDAGUtilityAccount\Desktop\Utils\Scripts\AdditionalScripts\InSandbox\installREToolkit.ps1</Command>
88130
```
89131

132+
> NOTE: if you want to use any script that requires network connectivity (`installREToolkit.ps1` OR `installChocoAndScoop.ps1` and dependent on it `installAnalysisTools.ps1`/`installForensicsTools.ps1`) in 'Analysis' or 'Forensics' profile - please toggle `<Networking>Default</Networking>` in respective `.wsb` file.
133+
90134
## Customization
91135

92136
The `.wsb` schema is documented by Microsoft: [Windows Sandbox configuration](https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file).
@@ -98,7 +142,9 @@ Common tweaks:
98142
- **GPU passthrough** — already `Default`; change to `Disable` if you want strict CPU-only execution
99143
- **Extra logon commands** — add more `<Command>` entries in `<LogonCommand>`
100144

101-
For one-off in-sandbox setup, edit `customScript.ps1` and uncomment its `<Command>` line in the wsb — keeps your customizations out of the always-run `setup.ps1`.
145+
For one-off in-sandbox setup, edit `customScript.ps1` and uncomment its `<Command>` line in your profile's wsb — keeps your customizations out of the always-run `setup.ps1`.
146+
147+
If you don't want a profile's writable `Output/` mapping persisting state on the host, comment out the `Output/` `MappedFolder` block in that wsb (it's marked with an inline comment).
102148

103149
## Security notes
104150

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
# you're limited only by your imagination (and googling skills), glhf ))
2-
Write-Host "customScript.ps1 ran add your code here." -ForegroundColor Cyan
2+
Write-Host "customScript.ps1 ran - add your code here." -ForegroundColor Cyan
Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#Requires -Version 5.1
2+
#Requires -RunAsAdministrator
3+
$ErrorActionPreference = 'Stop'
4+
5+
# Disables Windows Defender INSIDE the sandbox only. The sandbox runs as
6+
# WDAGUtilityAccount (admin) with its own Defender instance - this does NOT
7+
# touch Defender on your host. The setting evaporates with the sandbox.
8+
#
9+
# Use this when analyzing samples that Defender would otherwise quarantine.
10+
# For a softer touch (keep real-time scanning on, just whitelist Input/),
11+
# use excludeInputFromDefender.ps1 instead.
12+
13+
try {
14+
Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction Stop
15+
Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue
16+
Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue
17+
Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue
18+
Set-MpPreference -DisableScriptScanning $true -ErrorAction SilentlyContinue
19+
Set-MpPreference -MAPSReporting Disabled -ErrorAction SilentlyContinue
20+
Set-MpPreference -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue
21+
Write-Host "Defender (sandbox-local) disabled. Host Defender is unaffected." -ForegroundColor Yellow
22+
} catch {
23+
Write-Warning "Could not fully disable Defender - Tamper Protection may be active."
24+
Write-Warning "Error: $($_.Exception.Message)"
25+
Write-Warning "If Tamper Protection is on, disable it via Windows Security UI inside the sandbox, then re-run."
26+
}
Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#Requires -Version 5.1
2+
#Requires -RunAsAdministrator
3+
$ErrorActionPreference = 'Stop'
4+
5+
# Adds the mapped Input/ folder to Defender's exclusion list INSIDE the sandbox.
6+
# Real-time scanning stays on for everywhere else - only files under Input/ are
7+
# unscanned. Use this when you want Defender protecting the rest of the sandbox
8+
# while letting you handle samples in Input/. For a full disable, see
9+
# disableDefender.ps1.
10+
#
11+
# Host Defender is untouched.
12+
13+
$inputPath = 'C:\users\WDAGUtilityAccount\Desktop\Input'
14+
15+
if (-not (Test-Path $inputPath)) {
16+
Write-Warning "Input folder not found at $inputPath - is the profile mapping it?"
17+
}
18+
19+
try {
20+
Add-MpPreference -ExclusionPath $inputPath -ErrorAction Stop
21+
Write-Host "Added Defender exclusion for $inputPath (sandbox-local)." -ForegroundColor Yellow
22+
} catch {
23+
Write-Warning "Could not add Defender exclusion - Tamper Protection may be active."
24+
Write-Warning "Error: $($_.Exception.Message)"
25+
}

0 commit comments

Comments
 (0)