As with AV and NGAV, sandbox solutions struggle when faced with ever-more sophisticated threats. Sandboxes were made to run and “detonate” hidden malware in effort to detect it before it gets onto the users’ devices. However, modern malware has evolved to use numerous sandbox evasion techniques, such as multiple ways of delaying the initial malware execution, detecting whether the malware is running in a virtualized environment or hardware, checking for user interaction, unhooking from any detection tools, and many more. As a result, sandboxes consume a very long time trying to detect threats, have a very high failure rate, and therefore are no longer the magic bullet they were once considered to be.

DISARM takes any suspicious documents and detonates them inside its advanced Content Sandbox. The Disarm Content Sandbox is uniquely designed to handle documents as they are opened by different host applications. Unlike most sandbox solutions, the DISARM sandbox runs such host applications while monitoring each machine instruction execution in real-time, thereby detecting and thwarting any attempt of memory or registry corruption (e.g. change of ROP or EIP), persistency, process creation, virtual machine detection and evasion, and many other exploits before it can even execute. Thanks to this unique architecture, it is not necessary to wait and retrospectively look at what the sandbox environment looks like post-execution. Average scans are up to five times faster than those of legacy sandboxes. Moreover, real-time inspection at a machine-code instruction resolution allows to more effectively deal with sandbox evasion techniques and to deliver better accuracy with up to ten times lower false positives and negatives.

Documents going into the DISARM service first go through advanced static and dynamic analysis and tested against a threat intelligence feed. Any known threats are likely to be caught and neutralized at this point.

For more information, please read the "DISARM White Paper" and the "DISARM Content Security for MS Exchange Online Manual".

If you need further discussion, please contact us at "global@seculetter.com".