AwesomeREA.org

Tool

Noriben

Python script that drives Sysinternals Process Monitor to record what a program does while it runs, filters out routine system activity and writes a text report of the processes it created and its file, registry and network activity. It works as a lightweight malware sandbox and can also log events while the analyst runs a sample by hand, with command-line options, user interaction or under a debugger; created files can be scanned with YARA rules and their hashes looked up on VirusTotal. Version 2.1.0 adds DLL-load monitoring, an ASCII process tree and JSON output, and NoribenSandbox.py automates runs inside a guest VM.

Targets
Binary
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Prerequisites: Python 3 and Sysinternals procmon.exe or procmon64.exe on the Windows analysis machine; yara-python is optional for --yara scans and requests for VirusTotal lookups. Release at review: 2.1.0, published 2026-11-03, whose tag is the reviewed main commit.
  • Scope: The README's sandbox workflow runs a sample in a VM, copies the results off and reverts before the next sample. NoribenSandbox.py starts a predefined VM snapshot, copies in the sample, runs Noriben and retrieves a ZIP report and a screenshot; the README says this front end currently runs on macOS hosts.
  • Limits: With a VirusTotal API key it looks up file hashes; uploading every created file to VirusTotal happens only when virustotal_upload is set to True in Noriben.config, which defaults to False.
  • Testing evidence: The 2.1.0 notes add large-scale unit testing, developed with AI assistance; the README runs tests/unit_tester.ps1 through Noriben in a Windows VM with Procmon module loads enabled.
  • License: Apache-2.0 per the README and LICENSE.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · Rurik/Noriben · Revision 4c84a98
  2. Noriben.py#L1410-L1465 GitHub · Rurik/Noriben · Revision 4c84a98
  3. Noriben.config GitHub · Rurik/Noriben · Revision 4c84a98
  4. LICENSE GitHub · Rurik/Noriben · Revision 4c84a98
  5. https://github.com/Rurik/Noriben/releases/tag/2.1.0

More in Native binaries

All 166 entries in Native binaries