Detonation Chamber

Service Dashboard

Recent Activity

No recent activity. Submit a sample to begin.

RUSTINEL TRACE Analysis Console

-- -- -- windows 0 processes 0 events 0m 0s --

TIMELINE

Critical/High Process Network DNS File Registry

PROCESS TREE (0) — TIME FROM START

Select a process to inspect its details.

Process Malicious Detonated Network DNS File Registry Spawned Connection Injection

Select a node

Sysmon Events

AV/AMSI Scanner

🔍

Drop a file to scan or browse

or enter VM path:

Tool: Engine: Type:

Select a file and click Scan to analyze it against Defender/AMSI signatures.

Scan History

Hex Editor

📂

Drop a file here or browse

or enter VM path:

No file loaded

Offset: 0x00000000 No selection -- Size: --

DATA INSPECTOR

Int8--

UInt8--

Int16 LE--

UInt16 LE--

Int32 LE--

UInt32 LE--

Float32--

Float64--

ASCII--

UTF-16 LE--

ETW Browser

Windows Event Tracing — live event stream viewer

Auto (5s)

Select a channel and click Refresh

LitterBox

📦 Drop file to upload to LitterBox

Submit Sample

⬆

Drop file here or click to browse

Target: EDR Mode:

Submission History

Loading submissions...

Method	Endpoint	Description
GET	`/api/alerts`	All detection alerts (Rustinel + Fibratus + LitterBox)
GET	`/api/processes`	Tracked processes with activity counts
GET	`/api/status`	Service health status (all components)
GET	`/api/rustinel`	Rustinel engine info (rules, version)
GET	`/api/submissions`	Submission history (last 200)

Method	Endpoint	Description
POST	`/api/submit`	Submit sample (multipart). Params: `file`, `target` (agent/litterbox/both)
GET	`/api/detonation/results`	Poll results. Params: `sha256`, `pid`, `litterbox_hash`

Method	Endpoint	Description
GET	`/api/file/hex`	Hex dump. Params: `path`, `offset`, `bytes`
POST	`/api/file/hex/upload`	Upload file for hex viewing
GET	`/api/file/pe`	PE header analysis. Param: `path`

Method	Endpoint	Description
POST	`/api/scan/threatcheck`	ThreatCheck scan. Params: `file`/`path`, `engine`, `type`
POST	`/api/scan/defendercheck`	DefenderCheck scan. Params: `file`/`path`
GET	`/api/scan/status`	Scanner tool availability

Method	Endpoint	Description
GET/POST	`/api/litterbox/<path>`	Proxy to LitterBox API (:1337)
GET	`/api/fibratus/<path>`	Proxy to Fibratus API (:8180)

Service Dashboard

Recent Activity

Sysmon Events

AV/AMSI Scanner

Scan History

Hex Editor

PE Header Analysis

ELF Binary Analysis

ETW Browser

LitterBox

Submit Sample

Submission History

Service	Port	Purpose	Technology
Web UI	9000	Unified dashboard & API gateway	Python / Flask
DetonatorAgent	8080	Executes malware samples, returns PID	.NET 8.0
LitterBox	1337	Static + dynamic analysis sandbox	Python / Flask
Fibratus	8180	Kernel ETW telemetry & behavior rules	Go
Rustinel	—	Sigma/YARA/IOC real-time detection	Rust
Sysmon	—	Windows event logging (process, network, file)	Sysinternals
Detonator	5000/8000	Orchestration UI + REST API	Python

Service Dashboard

Recent Activity

Sysmon Events

AV/AMSI Scanner

Scan History

Hex Editor

PE Header Analysis

ELF Binary Analysis

ETW Browser

LitterBox

Submit Sample

Submission History

Transportable Detonation Chamber

What is Detonation Chamber?

Key Capabilities

Workflow

Tab Guide

Dashboard

Tracing

Graph

Sysmon

Scanner

Hex Editor

Submit

API Metamodel

Core APIs

Submission & Detonation

Hex Editor & PE Analysis

Scanner

Proxy Endpoints

Architecture

Data Flow

File Layout

Services

Detection Rules

PE Analysis Capabilities