Enumerating Anti-Sandboxing Techniques

This research report details creating benign Windows binaries that implement various anti-sandbox checks and submitting them to VirusTotal, Hybrid Analysis, and MetaDefender (June 2018) to measure which sandbox-evasion techniques are most likely to be detected. Results show that sleep delays, AV/process-name checks, and disk-size checks commonly trigger detections, while checks like domain membership, uptime, and RAM size were less likely to be flagged.