BlackSnufkin/LitterBox

A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.

What it solves

LitterBox provides a self-hosted environment for red teams and blue teams to analyze payloads before deployment. It eliminates the guesswork of whether a payload will be detected by security software by providing a consolidated "Detection Score" and a detailed breakdown of triggering indicators.

How it works

Users upload a sample to the sandbox, which then runs a battery of static and dynamic analysis tools. It can execute these scanners in parallel and can optionally dispatch payloads to a separate, EDR-instrumented Windows VM (using tools like Elastic Defend or Fibratus) to pull real-world detection alerts back into the same results page. The system includes a CLI, a Python library, and an MCP for LLM integration.

Who it’s for

  • Red Teams: To verify if payloads are "field-ready" and avoid detection during engagements.
  • Blue Teams: To integrate the platform into their malware analysis workflows.

Highlights

  • Integrated Scanner Suite: Bundles multiple industry tools including PE-Sieve, Hollows-Hunter, Moneta, and YARA.
  • EDR Integration: Ability to dispatch samples to real EDR-instrumented VMs for live testing.
  • Detection Scoring: Provides a unified score to quantify the likelihood of detection.
  • LLM Ready: Includes a Model Context Protocol (MCP) implementation for AI-assisted analysis.