Windows Sandbox Execution by Non-Interactive Account

Jorden Smith@Jorden

•updated Jan 8, 2026•0•20

Detects Windows Sandbox launched by non-interactive accounts such as SYSTEM or service accounts, indicating automated malicious execution.