Virtualization/sandbox evasion is a technique category used by malware, droppers, and other hostile code to detect when it is running inside a virtual machine, emulator, or security sandbox, and then change behavior or refuse to run. Attackers use it to avoid being studied by analysts and to bypass automated detection systems that rely on controlled execution environments.
This matters because sandboxes are a core defense for catching unknown threats before they reach real users or hosts. Evasion can be simple, such as checking for VM-specific hardware, drivers, or low system resources, or more advanced, such as delaying execution, looking for debugging tools, or testing network and file-system behavior. Defenders respond with more realistic environments, anti-tamper controls, layered monitoring, and correlation across hosts and networks. In practice, successful evasion can let malware hide its payload, conceal command-and-control traffic, or wait until it reaches a live system before acting.