A transit IR playbook lists sandbox evasion and VM artifact checks under one heading and beaconing to a controller under another. How should analysts categorize sandbox evasion?

Sandbox evasion and VM artifact checks are anti-analysis behaviors: the sample tries to detect examination environments and withhold or change malicious actions. Command-and-control beaconing is communication with a controller after or during execution. A transit IR playbook that lists sandbox evasion under one heading and beaconing under another is correctly teaching analysts to categorize sandbox evasion as anti-analysis, distinct from C2 communication. Mixing those headings would send responders hunting the wrong telemetry—lab-evasion logic versus network callbacks from jumphosts or garage systems.

Calling sandbox evasion identical to beaconing C2 traffic fails because evasion checks are about environment detection, not the callback channel itself. Authorized GoPhish campaign metrics collection fails; phishing-platform metrics are awareness/assessment tooling, not malware anti-analysis. OSINT gathering of public transit schedules fails because open-source schedule research is not sandbox evasion categorization.

Exam caveat: anti-analysis and C2 can appear in the same family, but they are different fundamentals and different hunt hypotheses. GOAA rewards keeping playbook headings clean.

Operational check for transit IR: for suspected anti-analysis, note environment checks and withheld behaviors in lab notes; for C2, prioritize network destinations, beacon intervals, and proxy logs on jumphosts. Use separate containment questions—‘is it hiding from analysis?’ versus ‘is it calling home?’—so garage and OCC Windows hosts get the right follow-up.