Cyber Defense eMagazine December Edition for 2021

Why Do You Need a Malware Sandbox?
By ANY.RUN Team
To solve the problem of identifying previously unknown malware samples help malware sandboxes –
protection systems that allow you to evaluate the security of software by running and analyzing it in an
isolated virtual environment. This article will lead you through all the details of what it is and why any
organization needs this service.
What is a malware sandbox?
Malware sandbox is an established class of solutions on the market. The main task of a sandbox is to
check the objects placed in it, collect events in the network for further analysis, as well as process the
collected data. Each event is verified according to configured policies.
A sandbox is an isolated environment where an object, such as a suspicious file, is sent for analysis. The
sandbox collects as much telemetry and context as possible from the pre-configured sensors in the
network. The sensors can be any existing device or application: a mail gateway, workstation agents, or
a firewall that sends files to the sandbox for inspection. Or a malware analyst can upload a file or submit
a link for further research by themselves.
It is important to check malware in different circumstances. And almost all operating systems are
supported by a sandbox to reveal malware behavior. A customized sandbox is already a tool against
targeted attacks. Customization, as always, depends on the user's priorities.
Cyber Defense eMagazine – December 2021 Edition 76
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.