Microsoft didn’t sandbox Windows Defender, so I did

Summary: A Trail of Bits researcher sandboxed Windows Defender as a proof of concept, releasing the code as Flying Sandbox Monster, built on a Rust framework called AppJailLauncher-rs that contains untrustworthy apps in AppContainers. The post notes that the core Defender process MsMpEng runs as a SYSTEM-privileged service and its scanning component MpEngine parses a vast number of file formats with full-system emulators and language interpreters, all at the highest privilege level.
What's compelling: The antivirus agent with SYSTEM privileges parses an enormous range of hazardous file formats, and Microsoft shipped it without the sandboxing it applied to other high-value surfaces like Edge's JIT code.

Read the original at Trail of Bits Blog ↗