open sketchy attachments safely with windows sandbox

that attachment is probably fine. probably.

someone sends you an invoice.zip, a "resume.docx.exe" with a weird double extension, or a pdf from a client you've never heard of. you know you shouldn't open it. you also kind of have to, because maybe it's real. this is the exact moment windows sandbox exists for, and most people with windows pro or enterprise have had it sitting there unused this whole time.

what windows sandbox actually is

windows sandbox is a disposable virtual desktop that microsoft built directly into windows. it spins up a clean, isolated copy of windows in seconds, using a lightweight version of hyper-v virtualization. you open your sketchy file inside that throwaway environment instead of on your real desktop. if the file is malware, it runs its little heart out in a box with nothing valuable in it. when you're done, you close the window and the entire environment, every registry change, every dropped file, every process it tried to persist, gets wiped. nothing carries over to your actual machine.

the best part is the price: zero dollars, because it's already part of the os. no separate vm software to install, no snapshots to manage, no license to buy.

turning it on

sandbox isn't enabled by default, so you have to flip it on once. open powershell as administrator and run:

Enable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM -All

breaking that down: Enable-WindowsOptionalFeature is the powershell command for turning on optional windows components without digging through the control panel gui. -Online tells it to apply the change to the windows installation you're currently running, not some offline image. -FeatureName Containers-DisposableClientVM is the actual internal name for windows sandbox, which is a weirdly technical label for what is basically "disposable vm." -All makes sure any dependent features get enabled too, so you don't hit a cryptic error halfway through. you'll need to reboot once it finishes.

also worth checking before you bother: this needs windows 10 or 11 pro, enterprise, or education, with virtualization enabled in your bios. home edition doesn't get this feature, which is annoying but not the end of the world, there are other sandboxing tools for home users too.

locking it down further with a config file

by default, sandbox still has internet access, which is fine for most testing but not ideal if you're deliberately opening something you suspect is malicious and don't want it phoning home. you can control that with a .wsb configuration file, which is just an xml file you double click to launch sandbox with specific settings.

a minimal config that disables networking looks like this:

<Configuration>
  <Networking>Disable</Networking>
</Configuration>

save that as something like noNetwork.wsb and double clicking it launches sandbox with no network card at all. that's useful for suspicious attachments that might try to download a second stage payload or beacon out to a command and control server the second they run. no network, no callback, no second stage.

actually using it day to day

the workflow is simple and doesn't require any security expertise. launch the sandbox (either the default shortcut from the start menu, or your custom .wsb file), then drag or copy the suspicious attachment into that sandbox window, and open it there like you normally would. watch what happens. if it's a document that just wants to show you content, fine, you're not even at risk in your real environment. if it tries to launch powershell, drop files, or do anything that smells like malware, let it, because none of that touches your host.

when you're done, just close the sandbox window. it asks if you want to discard changes, you say yes, and the entire thing disappears. next time you open it, it's a completely fresh windows instance again.

the takeaway

windows sandbox turns "should i open this" into a non-issue, because the blast radius is a disposable vm instead of your actual files, browser sessions, and saved passwords. it's built in, it's free, and most people never flip it on. enable it today before you need it, not during the moment you're staring at a weird attachment deciding whether today's the day you get popped. send this to the one person in your life who opens everything.