Understanding what a sandbox is
Whenever we execute an application, be it legitimate or malicious, some of the events that occur are as follows:
- The application directly interacts with the host operating system.
- System calls are made.
- Network connections are established.
- Registry entries are modified.
- Event logs are written out.
- Temporary files are created or deleted.
- New processes are spawned.
- Configuration files are updated.
All the preceding events are persistent in nature and change the state of the target system. Now, there might be a scenario wherein we have to test a malicious program in a controlled manner, such that the state of the test system remains unchanged. This is exactly where a sandbox can play an important role.
Imagine that a sandbox is an isolated container or compartment. Anything that is executed within a sandbox stays within it and does not impact the outside world. Running a payload sample within a sandbox will...