Kaspersky Research Sandbox

What Kaspersky Research Sandbox is

Kaspersky Research Sandbox analyzes suspicious objects to investigate their origins, gather behavior-based indicators of compromise and identify previously unseen malicious objects. It is available in cloud and on-premise deployments, including secure air-gapped environments. Behavioral analysis uses extended logging and in-depth reports to expose file activity; anti-evasion measures draw on Kaspersky’s malware behavior knowledge to help keep the sandbox environment undetected. Teams can customize guest operating system images to resemble their own environments. Version 3.0 adds VNC visual interaction, allowing analysts to interact with a sample as it runs, and uses Microsoft AMSI output to improve detection of packed and obfuscated scripts, including PowerShell activity. Static analysis examines strings, headers, sections, import and export tables, and entropy graphs, including files for systems such as macOS that are not supported for dynamic analysis. An API submits suspicious files for analysis and exports results to a SOC task management system. The product can also integrate with Kaspersky Private Security Network. Pricing is available on request.