Kaspersky
SandboxFully automated advanced detection and remediation against evasive threats

Key benefits• Advanced protection fromthe growing number ofnew, unknown and evasivethreats• Easy to manage – fully
automated• No additional investments
in internal IT security
expertise necessary• No impact on systems
performance and user
experience/productivity• Part of the Kaspersky
security ecosystem,
providing seamless multilayered protection

The challenge
Today’s threats use a wide range of techniques to avoid detection by endpoint
protection platforms. These evasive threats include:• Previously unknown malware• New viruses and ransomware• Zero-day exploits, and others
This leads to threats being able to burrow into targeted systems and stay undetected
for prolonged periods of time, radically increasing the damage, be it data exfiltration,
ransomware, financial or other types of spyware.

The solution
Kaspersky Sandbox automatically detects evasive threats, even dormant ones, byusing sophisticated patented detection technology1 .
The algorithm uses dynamic emulation of threats, allowing them to run in a seemingly
unprotected isolated environment, and analyzes the file’s behavior and generated
traffic by a variety of factors.
Today’s malware usually tries to detect if it’s in a sandbox and evade detection, which
is why Kaspersky Sandbox uses a variety of advanced anti-evasion and non-intrusive
monitoring techniques.

Evasive threats
Some threats try to avoid
detection by not performing
any actions which are likely tobe picked up by behavior
detection, effectively staying
dormant until the defenses ofthe endpoint are weakened– usually following a human
mistake.
Another way of avoiding
detection is to perform
actions over a very long
period of time, hours or days,
which can extend beyond thecorrelation period forendpoint protection
software’s behavior analysis.

1

Patent no. US 10339301B2

Use cases
Kaspersky Sandbox’s enhanced detection is especially effective at uncovering thosetechniques that evasive malware uses to avoid being discovered by even the mostsophisticated endpoint behavior analysis engine. These techniques include, but are notlimited to:••••

Keylogging
Taking screenshots
Hidden recording of audio and video streams
Use of multiple interpreters (e.g. malware runs .bat, which runs PowerShell, which runs
VBS script)• Passwords grabbing (e.g. from browsers)• Crypto wallet addresses replacement in clipboard

Usability
Kaspersky Sandbox is designed for smaller cybersecurity teams and for organizations
whose cybersecurity is handled by IT Operations. It’s built for maximum automation, easeof deployment and endpoint productivity – and managed from a centralized console as apart of the Kaspersky security ecosystem.

How it works
Part of the Kaspersky securityecosystem

The Kaspersky Endpoint Security for Business agent requests data about a suspicious
object from the shared operational cache of verdicts, located on the Kaspersky
Sandbox server. If the object has already been scanned, Kaspersky Endpoint Security
for Business receives the verdict and applies one or more remediation actions:Kaspersky Sandbox is a part of theKaspersky Optimum Security solution,
designed to allow smaller IT security teams
to take on evasive threats without
overextending their resources. Learn more
here: https://go.kaspersky.com/optimum••••Delivery and scalability

Kaspersky Sandbox is provided as apreconfigured ISO image and can be
deployed on physical or virtual servers. With
configurations supporting from 250 up
to 5000 protected endpoints, the solution
scales easily, providing continuous
protection for infrastructures of any size.
Several servers can be clustered for morecapacity and high availability.

Integration• SIEM systems can receive information
about detections made by Kaspersky
Sandbox. This information is sent via
Kaspersky Security Center in the general
events flow.
• An API is implemented in Kaspersky
Sandbox for integration with othersolutions, allowing files to be sent toKaspersky Sandbox for scanning and file
reputations to be requested from it.

Remove and quarantine
Notify user
Start a critical areas scan
Search detected object on other machines within the managed network

If the verdict on an object’s reputation can’t be obtained from cache, the test object is
run in an environment isolated from the real infrastructure.
File scanning is performed in virtual machines equipped with tools that emulate a typicalworking environment (operating systems/installed applications).To detect the malicious
intent of an object, behavioral analysis and traffic analysis are carried out, artifacts arecollected and analyzed, and if the object performs malicious actions, the Sandbox
recognizes it as malware. During sandbox analysis, a verdict is assigned to the object.
Once the object emulation process is complete, the resulting verdict is sent in real-timeto the shared operational cache of verdicts, allowing other hosts with Kaspersky
Endpoint Security for Business or Kaspersky Endpoint Detection and Response
Optimum installed to quickly obtain data on the reputation of the scanned object
without having to analyze the same file again. This approach ensures rapid processingof suspicious objects, reduces the load on Kaspersky Sandbox servers, and improves
the speed and efficiency of the response to threats.
Kaspersky Sandbox is an essential addition to Kaspersky Optimum Security. It
automatically blocks new, unknown and evasive threats without the need for additional
resources, and frees up IT security analysts to focus on other tasks

Workstations /Servers

Shared cacheof verdicts

Object reputation request(synchronous mode)

KESB1

Load balancing

Response

High-availability
clusterKESB

Suspicious object analysis request(asynchronous mode)

Analysis result

InternetKESB

KSC2

Detection data export in CEF format
Centralized management / updates andhealth check

12

Kaspersky Endpoint Security for Business
Kaspersky Security Center

To find out more about how Kaspersky Sandbox enhances your protection against evasive threats, visit
http://www.kaspersky.com/enterprise-security/malware-sandbox.

Cyber Threats News: www.securelist.com
IT Security News: business.kaspersky.com
IT Security for SMB: kaspersky.com/business
IT Security for Enterprise: kaspersky.com/enterprisewww.kaspersky.com© 2021 AO Kaspersky Lab.
Registered trademarks and service marks are the propertyof their respective owners.

We are proven. We are independent. We aretransparent. We are committed to building a safer
world, where technology improves our lives. Whichis why we secure it, so everyone everywhere has theendless opportunities it brings. Bring on cybersecurity
for a safer tommorow.
Know more at kaspersky.com/transparency

SIEM