Dynamic Analysis for SOC
Dynamic malware analysis determines the impact of a file sample.
- must execute in a safe environment (i.e., sandbox)
- Security analysts use sandboxes to do three things:
- Confirm execution
- if nothing happens, your alert might be a decoy
- Extract runtime IOCs
- e.g., domains, mutexes, dropped payloads, feed hunts and detections
- Map to ATT&CK
- most sandboxes auto‑label behavior with technique IDs
- Confirm execution
Sandbox Tools
Most common:
- Hybrid Analysis (HA)
- focuses on behaviour trees and a clean MITRE ATT&CK heatmap
- suitable for a fast executive summary
- Joe Sandbox (JS)
- goes deep, covering system calls, strings, and memory dumps
- Great for reverse engineers and detection engineers
Sandboxing Limitations
- trusting sandbox analysis 100% can lead to false negatives, missed detections and incorrect conclusions
Limitations
- Sandbox Evasion Techniques
- Threat actors design payloads to detect and evade sandboxes, leading to false negatives
- Common evasion tactics:
- Environment Awareness Checks
- Malware checks for signs of virtualised/sandboxed environments
- Anti-Debugging & Anti-Sandboxing Tricks
- Malware conducts debugger detection and checks for unique hardware IDs
- Limited Execution Time & Coverage
- Most sandboxes terminate analysis after 2-5 minutes
- so multi-stage malware may not fully execute
- time-delayed attacks will evade detection
- so cross-reference other threat intelligence resources
- Encrypted & Obfuscated Traffic
- Many sandboxes cannot decrypt SSL/TLS traffic, leading to blind spots
- may result in:
- HTTPS C2 Traffic appearing with no payload visibility
- or malware utilising DNS tunnelling to hide data in DNS queries
- Fileless & Living-off-the-Land (LotL) Malware
- Some threats never touch disk, bypassing traditional sandbox analysis by employing PowerShell Attacks and WMI Persistence