I get sandbox alerts for old utility programs for old games. I think not having a certificate or exhibiting behavior common to some form of malware without matching a signature in the database will trigger the sandboxing.