What is ANY.RUN?
ANY.RUN is a cloud-based interactive malware analysis sandbox designed for SOC teams, threat analysts, and cybersecurity professionals. It enables users to safely detonate and analyze suspicious files, URLs, and email attachments in a controlled virtual environment. The platform provides real-time visibility into malware behavior, including process monitoring, network traffic analysis, memory forensics, and MITRE ATT&CK mapping.
With a global threat intelligence network fed by over 15,000 companies, ANY.RUN offers fresh IOCs, IOAs, and IOBs to accelerate threat detection and response. The platform supports multiple operating systems including Windows, Linux, macOS, and Android. It integrates with SIEM, TIP, and XDR solutions via API, SDK, and STIX/MISP formats, enhancing existing security infrastructure. ANY.RUN is SOC 2 Type II certified and offers privacy controls, team collaboration features, and Single Sign-On (SSO).
Features
- Interactive Sandbox: Real-time detonation and analysis of malware and phishing threats in customizable virtual machines.
- Global Threat Intelligence: Access to fresh IOCs, IOAs, and IOBs from over 15,000 contributing organizations.
- Multi-OS Support: Analyze threats on Windows, Linux, macOS, Android, and server environments.
- Real-Time Process Monitoring: Track system processes, network connections, and memory events live.
- MITRE ATT&CK Mapping: Automatically map observed behaviors to MITRE ATT&CK techniques.
- Integration Ready: REST API, SDK, and STIX/MISP export for seamless integration with SIEM, TIP, and XDR.
- Team Collaboration: Shared analysis history, productivity tracking, and role-based access control.
- Privacy & Compliance: SOC 2 Type II certified, private analyses, and SSO support.
Use Cases
- Malware analysis and reverse engineering
- Phishing email investigation
- Threat hunting and IOC extraction
- Incident response and digital forensics
- Security operations center (SOC) triage
- Managed security service provider (MSSP) operations
FAQs
-
How can I pay for a subscription?
You can pay via credit card or invoice for yearly plans. Contact sales for custom billing options. -
How can I get a free trial?
ANY.RUN offers a 14-day free trial for SOC teams. You can request it through the website's trial form. -
Who has access to my data?
Data privacy is controlled by your plan. Community analyses are public, while Hunter and Enterprise Suite plans offer private analyses. ANY.RUN is SOC 2 Type II certified. -
How many people can work on one account?
Hunter plan is for single professionals. Enterprise Suite supports team management with multiple users and role-based access. -
Where are your servers located?
ANY.RUN servers are located in the European Union. For specific details, contact support.
