The ZBS Labs lab consists of a bare-metal malware anaysis workstation, ZBS-Dynamic. This machine has support for interactive snapshotting. From a clean image I can detonate malware, no matter how noisy and destructive and monitor for activity. I can then restore the clean image, and mount the dirty image before the restore (as a drive) to grab any artifacts, malware samples or other file system changes made by the malware to be analyzed on the clean image.

This workstation is isolated by hardware firewall routing and rules (pfsense w/ Suricata). It then goes to an edge router, already isolated and with it's own subnet. The other networks are in their own VLAN, and have rules banning the certain physical addresses from the other VLAN, and will just not route that LAN's traffic.

Using AI, I was a able to put together a JupiterLab that does a fast static triage and MITRE categorization of a given malware sample

May the nervous and uncertain feeling you get just before you detonate malware on purpose never go away.