Not So Fast My Friend – Using Inverted Timing Attacks to Bypass Dynamic Analysis (labs.lastline.com)

Great article. It's amazing to me that so many professionals see sandboxes as a general checkmark type defense investment. If your sandbox doesn't sit at the low level, even amateur hackers will own you.