Scanning Files in the Sandbox

Static analysis leverages machine learning (ML) models to detect threats by analyzing file properties without execution. The Sandbox static analysis:

Dynamic analysis executes the files in the isolated environment to observe their behavior and detect malicious activity. The Sandbox dynamic analysis:

Company ABC's relies on detection-only anti-malware solutions. This does not provide visibility into how a threat operates and prevents them from fully understanding attack tactics, payload behavior, or potential system impacts.

To address this, they enable the Sandbox to enhance their threat analysis capabilities. When a suspicious file is detected, it is automatically sent to the sandbox environment for Static and Dynamic analysis. The Sandbox monitors activities such as unexpected network connections, attempts to modify critical files, or privilege escalation efforts.

From the scan report the company can:

Using the Sandbox feature, reduces Mean Time to Detect and Mean Time to Respond, and strengthens their overall security posture.

An employee at company ABC received an email with a suspicious file that is blocked by their Anti-Malware policy. The employee contacts the IT security team claiming the file is safe and they require access to it.

Before providing the employee access to the file, they upload it to the Sandbox so it can be executed in a controlled environment.

The Dynamic analysis in the Sandbox identified the file attempted privilege escalation techniques and has a malicious verdict. The IT team do not provide access to the file and avoid a potential attack.