Detonate vs DRAKVUF Sandbox

Detonate runs software dependencies in isolated micro-virtual machines and monitors their runtime behavior for software supply chain security. It accepts npm and PyPI packages, Maven artifacts, binaries, and Docker images, then records file access, network connections, DNS queries, and process execution. The product assigns benign, suspicious, or policy-violating verdicts and provides an event timeline. Decoy files such as fake SSH keys, cloud credentials, API tokens, and environment files can flag access attempts. A token-authenticated REST API supports artifact submission, status checks, verdicts, and reports for CI/CD deployment gates. The sandbox has no internet connection by default; outbound connections can be logged and optionally blocked. Described controls include Firecracker microVM and KVM hardware isolation, gVisor support, seccomp-BPF profiles, and read-only root filesystems with tmpfs overlays. Detonate supports API and web access, Linux, and self-hosted deployment. The Community plan is free and self-hosted, with 2 concurrent sandboxes and 200 API runs per month. Paid plans start at $4,990 a year; enterprise pricing starts at $14,990 a year.

DRAKVUF Sandbox is a free, GPL version 2 software project from CERT Polska for automated, black-box malware analysis. It uses the DRAKVUF engine and examines suspicious files without installing an agent inside the guest operating system. Files can be uploaded through a web interface, while an API, analysis queue, dashboard, Flask web application, rq worker and Redis support the workflow. Default plugins monitor WinAPI calls, file activity, memory regions, processes, network connections, DNS queries and TLS master keys. Reports show process trees, network and domain activity, modified or deleted files and high-level TTP indicators. Available downloads can include PCAP traffic, intercepted TLS keys and memory dumps. Uploads can disable guest internet access. On-premises deployment uses Xen 4.17 or later, with 4.19 recommended, on Debian 12 or Ubuntu 22.04 Intel hosts. Supported guests are Windows 10 x64 and Windows 7 x64.