Sandbox.

What is a sandbox?

A sandbox is a place where a program can run with tight limits. NIST defines it as a restricted, controlled execution environment that prevents potentially malicious software, such as mobile code, from accessing any system resources except those for which the software is authorized. Another NIST publication, SP 800-95, describes it as a system that allows an untrusted application to run in a highly controlled environment where the application’s permissions are restricted to an essential set of computer permissions.

How does a sandbox work?

The idea is isolation and limits. The program inside gets only the permissions it needs, and nothing else on the system is open to it. NIST SP 800-125, which covers virtualization, describes a related approach: isolating each guest operating system from the others and restricting what resources they can access and what privileges they have. A guest operating system is a full system that runs inside another one. Security teams often use the same idea to open a suspicious file in a contained space and watch what it does, so the rest of the network is not at risk. That use is a general practice, and the NIST definitions describe the restriction itself.

Why does it matter?

A sandbox lets people handle software they do not trust. If a file turns out to be harmful, the restrictions are meant to keep the harm inside the sandbox. This suggests that a sandbox can reduce risk, but it only works as well as the limits placed on it. Attackers know this, and MITRE ATT&CK lists a technique called Virtualization/Sandbox Evasion (T1497), where adversaries may employ various means to detect and avoid virtualization and analysis environments.

How can attackers get around it, and what can defenders do?

MITRE describes three kinds of sandbox evasion check.

• System checks, which look for signs of virtual machines or sandboxes and for security tools.
• User activity based checks, which look at whether real user activity is present.
• Time based checks, such as sleep timers that avoid running within a temporary sandbox.

MITRE says this type of technique cannot be easily mitigated with preventive controls, since it is based on the abuse of system features. For detection, it points to monitoring for discovery commands aimed at virtualization artifacts, tracking commands that list virtualization files or processes, and spotting scripts that check for virtualization indicators together with delay functions or suspicious system activity.

Is a sandbox the same as a virtual machine?

Not exactly. A virtual machine is a software-based computer. It can be used to build a sandbox, but a sandbox is defined by its restrictions, not by the technology underneath. NIST describes a sandbox by what the software is allowed to reach.

Is a sandbox the same as antivirus?

No. Antivirus checks files against what it knows. A sandbox runs the software in a restricted space so its behavior can be watched or contained.

Related pages in the Knowledge Hub

• Virtualization/Sandbox Evasion

Sources

• NIST: NIST glossary definitions of sandbox (CNSSI 4009, SP 800-95, SP 800-125, SP 1800-21B).
• MITRE ATT&CK: T1497 Virtualization/Sandbox Evasion: description, sub-techniques, mitigation and detection.