In reply to Robert Mclendon.

Hi Robert,
Malware authors often design their attacks to check for the presence of a debugger, as this is an indication that the malware is being analyzed. They typically do this by checking to see if a PE file imports the IsDebuggerPresent symbol.
However, this is just one of over a hundred different techniques that we are aware of, that they use to detect the presence of a sandbox. Our experienced malware team actively works on ensuring we keep up-to-date on the latest techniques being used, and we apply this knowledge so that the AMP Threat Grid malware analysis and threat intelligence platform can detect and report when we see a file submission trying to detect and/or evade a sandbox'd environment.