Home
LitterBox is a self-hosted payload-analysis sandbox for red teams: upload a sample, run static / dynamic / EDR analysis against it, get a Detection Score and a triggering-indicators breakdown, decide whether the payload is field-ready.
This wiki covers the operator-facing material that doesn't fit in the README — long-form setup guides, troubleshooting trees, the full HTTP API catalog, and developer references.
New here? Read the README first for installation. Come back here once you have the dashboard up at
http://127.0.0.1:1337.
| If you want to… | Go to |
|---|---|
| Understand how the pieces fit together | Application Architecture |
| Run static / dynamic on a sample | The README quick-start |
| Dispatch a payload to a real EDR | EDR Integration → either Elastic Defend Setup or Fibratus Setup |
| Run everything at once | All in One Pipeline |
| Drive LitterBox from a script / LLM agent | GrumpyCats CLI, GrumpyCats Library, LitterBoxMCP |
| Read a result page | Detection Score Explained |
| Configure scanners / paths / timeouts | Configuration Reference |
| Add custom YARA rules | YARA Rules Management |
| Build your own scanner | New Scanner |
-
EDR integration — dispatch a payload to a separate EDR-instrumented Windows VM, pull correlated detection alerts back. Two profile kinds:
kind: elastic(queries Elastic Defend's alert index) andkind: fibratus(polls the open-source Fibratus ETW engine via the local Windows event log). -
Whiskers — single-binary Rust HTTP agent that runs on the EDR VM. Lock + multipart exec + log fetch + Fibratus event-log query. Ships with
--installfor an at-logon Windows scheduled task. -
System dashboard at
/— live scanner availability + EDR agent reachability, refreshes every minute, server-cached for instant loads. -
All-in-One Pipeline at
/analyze/all/<target>— coordinator runs Static + every reachable EDR profile in parallel, Dynamic waits for Static. -
Saved-view route
/results/edr/<profile>/<target>— same renderer as the live page (MITRE chips, call stack, expandable per-alert detail, raw_source). - Performance cluster — parallel static analyzers, mtime-validated dashboard cache, lazy saved-view fetch, adaptive EDR poll cadence, visibility-paused polling.
-
GrumpyCats package split — 6 new CLI commands, library import is now
from litterbox_client import LitterBoxClient, MCP tool count 22 → 29.
Full details in the CHANGELOG.
