Process and analysis

What is Sandbox?

A controlled environment that runs a suspect file and reports what it did. A public one is publication: other people can retrieve what you upload.

A sandbox is a controlled environment that runs a suspicious file or opens a URL and records what happens: processes created, files written, registry changes, network connections. Results come back as a report.

Public online sandboxes are fast and convenient, but uploading is publishing. Other researchers, and attackers watching for their own samples, can see and download what you submit. Sensitive or targeted samples belong in a private sandbox.

Where you learn it

See Sandbox in a real investigation

Our missions put you in front of real logs, domains and forums, with these terms underlined where they appear.

Start learning free