DETONATE IT ON YOUR OWN RANGE
This playbook establishes what a file does on a host you own, without giving custody of the sample to anyone.
What you get
platform.
Execution timeline
Each command, its output, and the artifact it produced, in order.
Your registered host
Execution happens on the host you register.
Reusable indicators
Hosts, services, and findings from the run become typed Cybergraph nodes.
VirusTotal lookup
The one outbound step is a VirusTotal lookup, and it is yours to take.
Where it stops
This playbook will establish what one file did, on one host you dedicated, during one run. It does not clean up after that file, and it does not tell you where else it has been.
No remediation
You get the behaviour and the indicators.
Not incident response
Reconstructing how the sample arrived and what it touched across the estate is host and disk work, and a separate playbook.
No anti-evasion sandbox
The Vessel is a container, so sample logic that checks for one, waits out the run, or needs real user interaction will not be caught by it.
No disassembler in the image
Static work beyond identification, metadata, and byte carving needs a tool you install into the Vessel first.
No automatic intake
Nothing detonates because a mail gateway or an EDR queue submitted it.
Who this is for
Start testingMalware Analyst
Every sample costs you a day to unpack, triage and write up, and most of that day is the three steps you also did yesterday.
Detection Engineer
You need behaviour you can turn into a rule, not a hash you will never see again.
CISO
You need to know whether the thing that landed in one mailbox is commodity noise or somebody who came for you specifically.
Questions
Where does the sample actually run?
The sample runs inside a Vessel on a Tentacle — a container Cracken runs on a host you install it on. You choose the machine, and for detonation work that machine should be one you are prepared to destroy.
Does the file leave my environment?
On a self-managed deployment — private cloud, on-premises, or air-gapped — the file, the tool output, and the model traffic stay inside your boundary, using your own model keys or a self-hosted endpoint. On Cracken Cloud, an operation's uploaded assets and captured tool results are held in Cracken-managed storage, so if custody is the requirement, the deployment model is the thing to settle first.
Is this a replacement for our malware sandbox?
No. A dedicated sandbox brings hypervisor introspection, evasion countermeasures, and multiple operating-system images that this playbook does not plan to match. Its reason to exist is that the analysis is an operation in the same realm as your validation work, so what the sample points at can be tested rather than only filed.
Who will authorise a detonation?
A person does. Every action is evaluated against the realm's autonomy policy — an intrusiveness ceiling, an enabled tool set, and a target scope you set before the run — and anything above the ceiling waits for approval. The operation can be stopped while it is running.
Stand up the range before you have a sample.
Point External Attack Surface Discovery at a domain you own. The Vessels, the ledger and the approval gate under it are the same ones this playbook will use.