AI SOC: quarantine-sandbox malware analysis for attachment/link lures (validated by a real incident)

[seonghobae]

Motivating incident (real, 2026-07-08)

A user mapasevo21 (id 301144241, new account) posted a targeted social-engineering malware lure as comments on org issues ContextualWisdomLab/.github#365 and ContextualWisdomLab/naruon#977 — it READ the issue topic (CodeQL/SARIF ruleset) and offered a sarif_bypass_patch.zip "fix" (VirusTotal: multiple detections) claiming to "bypass the ruleset by spoofing the header". Classic maintainer-targeted supply-chain lure.

Handled MANUALLY this time: comments deleted, user org-blocked, VirusTotal (external) confirmed malicious. No sandbox/automation existed.

Capability this validates (Wardnet AI SOC + noema quarantine sandbox)

• Detect: watch org issue/PR comments for attachments/links + risk signals (new account, .zip/binary attachment, "bypass/patch/fix" lure, topic-targeting a live issue).
• Quarantine analysis: detonate/inspect the suspicious file in a lightweight isolated sandbox (noema quarantine) — static (YARA/signatures/entropy), dynamic (behavior), and reputation (VirusTotal API + hash lookup). NEVER analyze in a non-isolated env.
• Classify + auto-respond: on malicious verdict → auto-delete comment, block the user org-wide, alert, and record an incident. (Automates exactly what was done manually here.)
• Threat intel: retain IOCs (hashes, uploader, URLs) for correlation.

Cross-refs

• noema quarantine sandbox roadmap: ContextualWisdomLab/naruon#... (Project Bump actions/checkout from 4 to 7 #1, "noema: quarantine sandbox" item)
• Wardnet role: WAF/IDS/AI SOC/LB/APIM (org architecture map)
• Blocks/ties into the org security governance in ContextualWisdomLab/.github

[seonghobae]

Design refinement: WITHOUT VirusTotal (self-contained AI SOC)

No dependency on VirusTotal (or any external reputation service) — this is the real AI SOC: we determine maliciousness ourselves via behavior + AI reasoning. Trade-off: we lose the instant "known-malware" reputation fast-path, so every sample is actually analyzed (more compute + own rule/intel curation); gain: fully self-contained, permissive, genuinely reasoning-based.

Static (permissive): YARA (BSD) rules + capa (Apache-2.0, capability→ATT&CK mapping — verdict basis without signatures) + LIEF (Apache)/pefile (MIT) PE/ELF parsing + zip-unpack/macro extraction (oletools) + entropy (packing) + embedded script/URL extraction. Plus context heuristics (new account + bypass-patch.zip on a security issue is a strong signal pre-analysis). Exclude ClamAV (GPL).

Dynamic (self-contained sandbox = the core): detonate in a gVisor / Firecracker (both Apache-2.0) microVM with eBPF behavioral monitoring (Falco / Tetragon, Apache-2.0) — syscalls, file/process tree, dropped files; network sinkhole (any non-allowlisted outbound = C2 suspicion). Behavior-based verdict, no external reputation.

AI classification (the "AI" in AI SOC): feed static+dynamic features (capa capabilities, syscall traces, YARA hits, IOCs, lure context) to an LLM via contextual-orchestrator → verdict + reasoning (evidence reasoning, not a hash lookup). KG correlation: link uploader/IOCs across the org → campaign/repeat-offender detection; a self-hosted IOC DB grows our own reputation (VT replacement).

Response: auto delete comment + block user + alert + persist IOCs (automates the manual handling done for the mapasevo21 incident).

MVP without dynamic detonation = static (YARA+capa+unpack) + context heuristics + LLM reasoning + KG correlation + auto-response — already catches the mapasevo21-class lure. Add the microVM sandbox for full dynamic coverage. Needs only a sandbox host/runner (no external API keys).

[seonghobae]

Scope: SOURCE-AGNOSTIC artifact-analysis service (NOT coupled to GitHub comment events)

The GitHub-comment lure was just ONE trigger. The core is a standalone, source-agnostic quarantine artifact-analysis SERVICE (wardnet AI SOC + noema sandbox) with a clean API: submit(artifact/bytes/url, context) -> {verdict, confidence, evidence/report, IOCs}. Any source plugs in:

• naruon email + file attachments — the platform ingests attachments constantly; run them through quarantine analysis BEFORE storing/processing (this IS the backlog "lightweight quarantine sandbox for isolated file analysis").
• Platform uploads (any user-uploaded file), connector inputs (WebDAV/CardDAV/CalDAV proxy), API submissions.
• GitHub issue/PR comments — one trigger among many.

So do NOT build a GitHub-webhook bot; build the shared analysis ENGINE (static + sandbox-dynamic + LLM reasoning + KG/IOC correlation from the earlier comments), and add thin trigger adapters per source (email-ingest hook, upload hook, connector hook, GitHub-comment watcher). The verdict + auto-response policy is per-consumer (e.g. GitHub → delete+block; email → quarantine+flag; upload → reject+notify).