A sandbox is a restricted, controlled environment where software can run without reaching the rest of a system. NIST defines it as a restricted, controlled execution environment that prevents potentially malicious software from accessing any system resources except those for which the software is authorized.
- Also Called3other namessandboxing · sandbox environment · malware sandbox
- Related Terms3linked entriesMalware-as-a-service (MaaS) · Digital forensics
What Is a Sandbox?
A sandbox is a place where a program can run with tight limits. NIST defines it as a restricted, controlled execution environment. It prevents potentially malicious software, such as mobile code, from accessing any system resources except those for which the software is authorized. Another NIST publication, SP 800-95, describes it as a system that allows an untrusted application to run in a highly controlled environment. There the application’s permissions are restricted to an essential set of computer permissions.
What Limits Does a Sandbox Put on a Program?
The idea is isolation and limits. The program inside gets only the permissions it needs, and nothing else on the system is open to it.
NIST SP 800-125, which covers virtualization, describes a related approach: isolating each guest operating system from the others and restricting what resources they can access and what privileges they have. A guest operating system is a full system that runs inside another one. Security teams often use the same idea to open a suspicious file in a contained space. They watch what it does, so the rest of the network is not at risk. That use is a general practice, and the NIST definitions describe the restriction itself.
Why Do Teams Run Risky Files in One?
A sandbox lets people handle software they do not trust. If a file turns out to be harmful, the restrictions are meant to keep the harm inside the sandbox. This suggests that a sandbox can reduce risk, but it only works as well as the limits placed on it. Attackers know this, and MITRE ATT&CK lists a technique called Virtualization/Sandbox Evasion (T1497), where adversaries may employ various means to detect and avoid virtualization and analysis environments.
How Do Attackers Try to Spot a Sandbox?
MITRE describes three kinds of sandbox evasion check.
| ATT&CK ID | Check | What the malware looks at |
|---|---|---|
| T1497.001 | System checks | Memory, processes, file system, hardware and Registry for signs of a virtual machine. Also CPU core count, memory and drive size. |
| T1497.002 | User activity based checks. | Mouse speed and clicks, browser history, and the number of files in common folders. Some malware waits for a user action first. |
| T1497.003 | Time based checks | Uptime and the system clock. Malware can time a sleep call to see if a sandbox is speeding up time. |
MITRE says this type of technique cannot be easily mitigated with preventive controls, since it is based on the abuse of system features. For detection, it points to monitoring for discovery commands aimed at virtualization artifacts. It also points to tracking commands that list virtualization files or processes. A third sign is a script that checks for virtualization indicators together with delay functions or suspicious system activity.
Is a Sandbox the Same as a Virtual Machine?
Not exactly. A virtual machine is a software-based computer. It can be used to build a sandbox, but a sandbox is defined by its restrictions, not by the technology underneath. NIST describes a sandbox by what the software is allowed to reach.
Is a Sandbox the Same as Antivirus?
No. Antivirus checks files against what it knows. A sandbox runs the software in a restricted space so its behavior can be watched or contained. Attackers who hide what a file does, as described in obfuscation, are trying to get past both.
JetBrains CLion’s Safe Mode is one such sandbox; see how CVE-2026-123831 let a project’s Meson settings bypass it.
Related Pages in the Knowledge Hub
Sources
- NIST: NIST glossary definitions of sandbox (CNSSI 4009, SP 800-95, SP 800-125, SP 1800-21B).
- MITRE ATT&CK: T1497 Virtualization/Sandbox Evasion: description, sub-techniques, mitigation and detection.
- MITRE ATT&CK: T1497.001 System Checks: artifacts and system properties adversaries check.
- MITRE ATT&CK: T1497.002 User Activity Based Checks: mouse activity, history and files.
- MITRE ATT&CK: T1497.003 Time Based Checks: uptime, clock and sleep timing.
Also Called.
- Namesandboxing
- Namesandbox environment
- Namemalware sandbox
Questions.
-
What is a sandbox in cyber security?
A sandbox is a restricted, controlled environment where software can run without reaching the rest of a system. NIST describes it as preventing potentially malicious software from accessing any system resources except those it is authorized to use.
-
How does a sandbox work?
The program inside gets only the permissions it needs, and nothing else on the system is open to it. Security teams use the same idea to open a suspicious file in a contained space and watch what it does.
-
Can attackers detect a sandbox?
Yes. MITRE ATT&CK lists a technique called Virtualization/Sandbox Evasion, so attackers know sandboxes exist. A sandbox only works as well as the limits placed on it.
In Our Research
- 1 Why a CPython Bug Lets Attackers Escape AI Inference Sandboxes November 2026
- 2 Chrome CVE-2026-118306: Sandbox Escape Fixed in 156.0.8078.73 November 2026
- 3 Inside Prefab UI’s Sandbox Escape: The Chain Behind CVE-2026-120338 November 2026
- 4 Three Ways Beta9 Lets a Tenant Escape Its Sandbox November 2026
- 5 LXD and Incus: Six Advisories Trace How a Trusted Image Breaks Out November 2026
- 6 GPT-6 Cyber: How OpenAI’s Kernel Pipeline Works and What Defenders Should Change November 2026