Champlain College capstone · team project
Proxmox malware remediation lab
Deploy a disposable VM, detonate a sample in an isolated network, detect the behavior, then clean the box or rebuild it from a hashed golden image.
Overview
What it is
Manually resetting a machine after a malware test is slow, and the slow part is not the malware itself. It is chasing artifacts and proving the box is clean again. This project automates that loop. Ansible playbooks, driven through Semaphore (a web UI for running Ansible jobs), talk to Proxmox VE with qm and the QEMU guest agent. A run clones a golden template, brings up the guest, detonates a sample inside an isolated VLAN, scores the resulting behavior with a PowerShell detector, then cleans the guest or destroys and reclones it, and finally hashes it against the known good template.
The proposal target was to take an exercise that costs 3 to 5 days of manual artifact chasing down to under 24 to 48 hours automated. In practice, detect plus rebuild of a single VM takes minutes (stop, destroy, clone, start), and the in guest WannaCry cleanup path typically runs 20 to 90 seconds once the guest agent is up. This is a lab exercise environment, not a product.
Team credit: this is a four person capstone built with Snowboundport37 (me), seraphim, seraphimgerber, and ConnorEast. I am one of the authors, not the only one.
Demo
Videos
Recorded by Connor East. Start with the full playlist.
A 1080p copy also lives in the repo: capstone-demo-1080p.mp4.
Architecture
How the pieces connect
topology · no live addresses
Ansible + Semaphore
│
▼
Proxmox VE
│ qm clone / qm start / qm destroy
▼
QEMU guest agent (in-guest command channel)
├── Windows guests (win10 / win11 / winsrv)
├── Linux guests (ubu / ubusrv / rocky)
└── Velociraptor (endpoint visibility / artifact collection)
Isolated detonation VLAN
├── pfSense (segment firewall, no internet during detonation)
├── VyOS (gateway + DHCP roles)
├── Zeek (traffic monitoring)
└── FakeNet (answers callbacks so samples behave)
vmbr3
└── WAN-side bridge role, kept off the detonation segment
Process
How a run works
01
Deploy
Ansible clones the template for the role you asked for and starts the VM.
02
Recon
QemuAgent_Online waits for the guest agent (the small service inside the VM that lets the host run commands without network access), then IP_collect grabs the guest address.
03
Detonate
The sample runs inside the isolated segment, with no route out to the internet.
04
Detect
windows-behavioral-detect.ps1 scores what changed on disk, in the registry, in running processes, and in PowerShell logging.
05
Cleanup or rebuild
Either kill and remove the artifacts in place, or destroy and reclone the VM.
06
Hash
SHA-256 the rebuilt disk state against the golden template record.
07
Tear down
Stop and destroy the throwaway guests so the next run starts clean.
Inventory
Lab roster
Roles and template VMIDs only no addresses, hostnames, or credentials.
| Role | Template VMID | Purpose |
|---|---|---|
| fakenet | 3000 | Answers malware callbacks with fake services |
| win10 | 3001 | Windows 10 detonation guest (default rebuild target) |
| win11 | 3002 | Windows 11 detonation guest |
| winsrv | 3003 | Windows Server role |
| ubusrv | 3004 | Ubuntu Server role |
| ubu | 3005 | Ubuntu desktop guest |
| rocky | 3006 | Rocky Linux guest |
| kali | 3007 | Analyst tooling |
| vyos | 3008 | VyOS router |
| pfsense | 3009 | Segment firewall |
| vyos-gw | 3010 | VyOS gateway role |
| vyos-dhcp | 3011 | VyOS DHCP role |
| zeek | 3012 | Network traffic monitoring |
| malware | 3013 | Sample-handling guest |
Rebuild map: win11 → 3002, server → 3003, malware → 3013, default 3001.
Detection
Detector scoring, in plain English
windows-behavioral-detect.ps1 doesn't match signatures. It looks at what a sample tends to leave behind and adds points:
Hash-like files
Filenames that look like hashes rather than words.
Bait names
Files named to look interesting to a user or to a script.
Run / RunOnce
Registry autostart keys that would bring the sample back on boot.
Noisy processes
Processes doing far more than the image should be doing.
PowerShell 4104 script blocks
Logged script text containing iwr, DownloadString, FromBase64String, or bitsadmin.
Example: if hashFiles.Count >= 3, the score gets +30. Cross the threshold and the guest is marked likely_infected. By default replace_infected=false, which makes a run report-only nothing is destroyed or recloned until you ask for it.
Coverage
Family playbooks
WannaCry
Real playbook. Looks for tasksche, mssecsvc, and wnry/wncry artifacts. In-guest cleanup typically completes in 20 to 90 seconds once the guest agent is up.
LokiBot
Real playbook. Keeps the packet captures from the run, and only exits 0 when the check actually reports PASSED so a silent failure doesn't look like a success.
Agent Tesla
An early stage playbook covering sample staging and cleanup steps for an infostealer detonation. It is scaffolded rather than validated, so it is documented here as in progress work instead of a finished remediation path like the other two.
Scope
What it is not
No Splunk. No Cuckoo. No YARA rules. This is not a production EDR and it is not a malware analysis sandbox with a report pipeline. It's a lab automation project: deterministic deploys, a behavioral scoring script, and a fast, verifiable path back to a known-good image.
Open to 2026 roles
Easiest way to reach me is email
Security operations, IT infrastructure, or systems and network administration. I reply the same day.