Slib is a C# library that contains various checks to try to identify if a computer is a sandbox or not.

It is based on the methods defined by Checkpoint in the following link:

• https://evasions.checkpoint.com

• Check if specific files exist
• Check if specific directories are present
• Check if full path to the executable contains one of the specific strings
• Check if the executable is run from specific directory
• Check if the executable files with specific names are present in physical disk drives' root

• Check if particular registry paths exist
• Check if particular registry keys contain specified strings

• Check if username is specific
• Check if computer name is specific
• Check if host name is specific
• Check if total RAM is low
• Check if screen resolution is non-usual for host OS
• Check if number of processors is low
• Check if quantity of monitors is small
• Check if hard disk drive size and free space are small
• Check if system uptime is small

• Check for specific global mutexes

• Check if windows with certain class names are present in the OS
• Check if top level windows' number is too small

• Checking debug privileges

• Check if specific files exist
• Check if specific libraries are loaded in the process address space
• Check number of processes:

• Check if MAC address is specific
• Check if adapter name is specific
• Check if network belongs to security perimeter
• Cuckoo ResultServer connection based anti-emulation technique

• Check if HDD has specific name
• Check if HDD Vendor ID has specific value
• Check if CPU temperature information is available

@aetsu