What does malware sandboxing enable security teams to collect?

• A. Network throughput metrics during testing.
• B. Indicators of compromise.
• C. User privacy data from the test environment.
• D. Marketing intelligence about malware authors.

Answer: (B)

Malware sandboxing enables security teams to observe how malware behaves in a safe, isolated environment. By running the code in a controlled sandbox, analysts can collect indicators of compromise—evidence of what the malware does, such as files created or modified, registry changes, new or unusual processes, persistence mechanisms, and network activity to command-and-control servers. These IOCs are essential for detecting threats, understanding attacker techniques, and guiding response actions. While sandboxing may surface various data, its primary purpose is not to measure network throughput, collect user privacy data, or gather marketing intelligence about malware authors.