ANY.RUN

ANY.RUN is a cloud-based malware analysis and threat intelligence service. It provides an interactive sandbox for detonating malware and phishing samples in virtual machines, allowing users to upload files or share links and observe behavior in real time. The service produces reports covering indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and MITRE ATT&CK mapping, helping security teams triage alerts, investigate incidents, and make faster decisions.

The Interactive Sandbox supports Windows, macOS, Linux, and Android virtual machines, with interactivity including typing, scrolling, clipboard access, and drag-and-drop. It analyzes network traffic, memory, and malware configurations, and generates Tier 1 reports with AI-powered action plans. Threat intelligence products include TI Lookup for indicator enrichment and YARA search, and TI Feeds for IOC, IOA, and IOB data. Integrations are available via API, SDK, and STIX/TAXII, with connectors for SIEM, TIP, SOAR, and XDR platforms such as Microsoft Defender, Sentinel, Splunk, QRadar, Elastic, and OpenCTI. The service is SOC 2 Type II compliant and supports SSO via SAML 2.0 and MFA.

ANY.RUN is designed for SOC teams, MSSPs, and independent malware analysts. A free plan is available for TI Lookup, and a 14-day free trial covers premium features. Analysis privacy controls, including public or private sessions, are available with Hunter and Enterprise Suite plans.