One-click pipeline: kicks off Static analysis on the LitterBox host AND dispatches to every registered EDR profile in parallel, then runs Dynamic analysis once those finish. Any failure in a parallel stage doesn't block the dynamic phase.
Shared across the dynamic + EDR runs. For DLL files the first argument is the exported entry point (e.g. DllMain) — passed to rundll32.exe on both sides.
{{ _mode_header('Static Analysis', 'No Execution Required') if false }}
Static Analysis
No Execution Required
Analyze payload content and structure without execution. Identifies signature-based patterns and static IOCs.
YARA Pattern Matching
CheckPlz
Stringnalyzer
Dynamic Analysis
Runtime Behaviour
Execute and monitor payload behaviour with memory analysis.
YARA Rules
RedEdr
Moneta
PE-Sieve
Hunt-Sleeping-Beacons
Patriot
Arguments passed to the payload at execution time. For DLL files the first argument is the exported entry point (e.g. DllMain) — passed to rundll32.exe.
{% for profile in edr_profiles %}
{{ profile.display_name }}
EDR Detonation
Dispatches the payload to {{ profile.agent_url }} via the Whiskers agent and pulls detection alerts from the configured backend.
Whiskers Agent Dispatch
EDR Alert Correlation
Execution Log Capture
Forwarded to the spawned process on the EDR VM. For DLL files the first argument is the exported entry point (e.g. DllMain) — passed to rundll32.exe.
{% endfor %}
Static Analysis
Driver Structure
Analyze driver content and structure without loading. Identifies signature-based patterns and static IOCs.
YARA Pattern Matching
Driver Structure Analysis
Import Analysis
HolyGrail BYOVD i
Driver Vulnerability
Specialised analysis for kernel drivers — identifies BYOVD vulnerabilities and abuse vectors.