Sandbox Evasion

Welcome to Sandbox Evasion

Lots of companies deploy a “Defense in Depth” strategy, which refers to implementing security in layers, so if one layer fails, there should be another one that an adversary must evade. In this room, we will be focusing on one unique type of active defense; Sandboxes. Sandboxes provide a safe way to analyze a potentially malicious file and observe the effects on the system and return if the executable is malicious or not.

Learning Objectives

In this room, we will learn about Sandboxes in-depth; by the time you finish this room, you will gain a better understanding of the following topics:

• Learn how Malware Sandboxes work
• Learn about Static and Dynamic Malware Analysis
• Common Sandbox Evasion Methods
• Developing and Testing Sandbox Evasion Methods with Any.Run

Room Pre-requisites

For this room, we recommend the prior experience in the following areas:

• Windows APIs
• C++ Programming
• Active Directory