Sandboxing with ESF Playground on macOS

Matt Carman opens by explaining what a malware sandbox does: it runs suspicious samples in a disposable environment, records execution, file writes and network activity, and then resets the system. He points out that the Cuckoo-based Mac sandbox he drew on stopped working after macOS system extension changes and Intel-related restrictions, and that commercial sandboxes are expensive and opaque. His goal was a small, low-cost system for Apple hardware.

The system he built, ESFriend, wraps ESF Playground in Python and runs on one physical Mac, with the server able to run on macOS, Windows or Linux. Physical hardware sidesteps many anti-VM and anti-debug checks. A MongoDB queue lets the analysis machine pull jobs without opening inbound ports. Traffic is captured through a man-in-the-middle proxy, and the reset relies on a paid snapshot utility. Because ESF produces a flood of events, he filters noise by hashing condensed event strings from a baseline run, a method he admits can filter too aggressively. A live demo failed because of network problems, so he walked through the results screens instead.

Planned work includes running as root to collect dropped files, network detection rules, virtualization once tools allow command-line control, similarity matching on event strings, automated detonation and a custom ESF agent. The takeaway is that a free, extensible triage pipeline on physical Macs is workable today, though its certificate-based proxy and reliance on Intel hardware limit it.