CIS Reintroduces MCAP Malware-Analysis Sandbox for SLTT Organizations
Summary
CIS has reintroduced MCAP, a web-based sandbox for U.S. SLTT MS-ISAC members to analyze suspicious files and URLs, with automated behavior reports and optional expert support.
Key points
- MCAP lets MS-ISAC members submit suspicious files and URLs for analysis in a controlled environment using Cisco Secure Malware Analytics.
- Reports capture process behavior, file changes, persistence activity, and network connections to support triage and incident response.
- Members retain ownership of submissions and can delete samples; the article says anonymized intelligence supports broader threat awareness.
- CIS's CTI and CIRT experts can help members interpret reports or conduct deeper analysis.
- Use cases include investigating phishing attachments and suspicious URLs, validating alerts, and deciding whether to escalate incidents.
- MCAP is available to U.S. SLTT MS-ISAC members; the article notes that MS-ISAC membership became fee-based on June 23, 2025.
Article Details
- Event Type
- Reintroduction of MCAP, a malware-analysis sandbox service for U.S. SLTT members.
- Impact
- The service enables MS-ISAC members to submit suspicious files and URLs for controlled analysis and receive automated reports on observable behavior to support triage and response. Members retain ownership of submissions and can delete samples; anonymized intelligence contributes to broader threat awareness.
Vendors
CISBased on continued member feedback and operational need, the Center for Internet Security® (CIS®) has reintroduced MCAP as a CIS‑delivered capability designed specifically to support U.S.CiscoUsing Cisco Secure Malware Analytics, the platform observes how a sample behaves during execution and captures key activity that helps teams understand potential impact.