There are a number of ways to check if an unknown computer in the inventory is a sandboxed machine:
Check operating‑system details: Sandboxes often use outdated OS images like Windows 7 or early builds of Windows 10; they lack your organization’s naming standards or endpoint management tools.
Look for virtual‑machine artefacts: Virtualization platforms leave tell‑tale signs. Examples include:
MAC address prefixes – VMware adapters typically start with 00:1C:14, 00:50:56, 00:05:69 or 00:0C:29; VirtualBox uses 08:00:27 and Hyper‑V uses 00:03:FF. Physical NICs from vendors like HP, Dell, Broadcom and Nvidia start with different prefixes.
Refer to MAC Address Vendors - Data Feed to look-up detailed information on physical NICs used in your environment.
Virtualisation registry keys/processes – Windows VMs often contain registry keys or services named after VMware or VirtualBox (e.g. VMTools, VBoxService, VBoxTray.exe). Their presence strongly suggests the machine is running in a virtual environment.
Unusual CPU/memory profiles – Sandboxes may have very few CPU cores, small memory or tiny disk sizes. MITRE ATT&CK notes that adversaries use system‑information checks (via WMI/PowerShell) to look for VM artefacts such as network adapter addresses, CPU core count and available memory/drive size; you can use the same checks to identify sandboxes.
Hostnames and file locations: Temporary machines may have generic hostnames (e.g. WIN7X64, VMware) or save the installer in paths containing names like sample, malware or long hash strings.
Assess user activity: Real endpoints show file changes, backups and user logins; a sandbox often shows no user activity. Malware‑analysis sandboxes also avoid common user actions like scrolling or mouse clicks.
Observe network behavior: Sandboxes frequently communicate from data center IP ranges or Tor exit nodes. They may contact the portal once during installation and never check in again.
Hardware/BIOS identifiers: CPUs in virtual machines often identify themselves as “VMware...” or “Microsoft HV”. The CPUID instruction can reveal this: bit 31 of the ECX register is 1 on a VM and 0 on physical hardware.
Refer to Malware Evasion Techniques Part 2: Anti-VM for detailed information on certain malware evasion techniques.
Automated heuristics: Using the ABR API, consider building automation into portal lists to flag devices that match multiple sandbox characteristics (e.g. old OS, VM MAC prefixes, generic hostnames, no backups etc.).
Refer to Unexpected Inventory Computers for more information.