ThreatLab

ThreatLab is a local malware analysis sandbox for security teams and MSPs. It runs on a Windows machine with Hyper-V and spins up isolated virtual machines to detonate and analyze suspicious files. Because analysis happens entirely on the user's own hardware, samples are never uploaded to a third party or shared with a public feed - a key difference from cloud-based sandboxes. Each analysis session captures behavioral telemetry using Sysmon and a large set of Sigma detection rules, with full process, network, file, and registry activity attributed to the process responsible. Sessions support full interactivity, so analysts can click through prompts, dismiss dialogs, and drive malware that requires user interaction. Completed sessions generate client-ready PDF reports. ThreatLab is aimed at teams that need private, on-premises analysis - including those handling client data under NDA, regulated data, or controlled technical information - without enterprise-tier pricing or a dedicated malware specialist on staff.