Kaspersky Research Sandbox

What Kaspersky Research Sandbox is

Kaspersky Research Sandbox analyzes suspicious objects to investigate their origins, collect behavior-based indicators of compromise, and detect previously unseen malicious objects. Kaspersky describes it as a product for security teams and threat researchers. Organizations can deploy it in the cloud or on-premise, including in secure air-gapped environments. Its behavioral analysis uses extended logging and in-depth reporting to show malicious file behavior, while anti-evasion measures draw on Kaspersky malware behavior knowledge to help keep the analysis environment undetected. Guest operating system images can be customized to resemble an organization’s environment. Version 3.0 adds VNC visual interaction, letting analysts interact with a sample’s execution environment while it runs, and incorporates Microsoft AMSI output to improve detection of packed and obfuscated scripts, including PowerShell activity. Extended static analysis examines strings, headers, sections, import and export tables, and entropy graphs. This can cover operating systems such as macOS, which is described for static analysis rather than dynamic analysis. An API can send suspicious files for analysis and export results to a SOC task management system. The sandbox can also integrate with Kaspersky Private Security Network. Kaspersky is a global cybersecurity and digital privacy company founded in 1997.

Who it suits

Kaspersky Research Sandbox is aimed at security teams and threat researchers investigating suspicious files and other objects. Its cloud, on-premise, and air-gapped deployment options suit organizations with different deployment environments.

Getting started

1. Visit the Kaspersky Research Sandbox product page.
2. Contact Kaspersky for pricing.
3. Choose a cloud or on-premise deployment model, including an air-gapped environment if needed.
4. Configure guest operating system images to resemble your environment.
5. Send suspicious files for analysis through the API.

Verdict

Consider Kaspersky Research Sandbox if your security team or threat researchers need behavioral and static analysis with cloud, on-premise, or air-gapped deployment. VNC interaction, customizable guest images, and API-based file submission support investigation workflows. Look elsewhere if you need a free plan or dynamic analysis for macOS.