Sandbox
Sandbox
Isolierte Ausführungsumgebung
A sandbox is a sealed-off environment in which suspicious code can be executed and observed safely without endangering the productive system. It is a central tool of dynamic malware analysis: instead of only statically inspecting a file, one sees what it actually does. At the same time, sandboxing is a protection principle of modern software.
History & facts. In analysis, a sandbox lets a suspicious file „detonate“ in a controlled way and logs its behaviour — which files it creates, which connections it establishes, which persistence it sets up. As a protection principle, modern browsers and operating systems isolate applications from one another so that a compromised component cannot reach the entire system. Advanced malware, however, tries to detect whether it is running in a sandbox and then behaves inconspicuously.
Outlook & recommendation. Sandboxing is effective but no panacea: evasion techniques and time-delayed behaviour can bypass observation. In practice, dynamic analysis complements static and behaviour-based detection at the endpoint. As a protection principle: the more consistently applications and privileges are separated, the smaller the damage of a single compromise.