Windows Defender: First Full Antivirus Tool to Run in a Sandbox

Sandboxed version now available to Windows Insiders and anyone else who force-enables it in Windows 10 version 1703 and above.

In a major move for Windows security, Microsoft has built Windows Defender to run in a sandboxed environment.
Microsoft began the process of moving Windows Defender to a sandbox after much input from the security community. Researchers inside and outside the company had detected ways an attacker could abuse flaws in the tools content parsers and enable arbitrary code execution.
But the project was a complex undertaking, said Mady Marinescu, of the Windows Defender Engineering team, and Eric Avena of Microsoft Content Experience, in a blog post on the news. The team had to study the implications for performance and functionality, as well as identify high-risk areas to make sure sandboxing didnt counter any existing security measures.
Windows Defender runs with high privileges to scan systems for malicious content; because of this, its already a prime target for cyberattacks. If someone successfully exploits a bug in Windows Defender, an entire system can be taken over. Microsoft reports it hasnt seen attacks targeting its antivirus tool in the wild, but it has been hardening Windows 10 over time with hardware-based isolation, network protection, controlled folder access, and other tech.
With Windows Defender running in a restrictive process execution environment, attackers who break in are stuck inside the isolated environment and cant affect the rest of the system.
In their post, Mainescu and Avenca
detailed the process
of balancing functionality and performance in the sandboxing. Microsoft had to, for example, consider risk functions such as scanning untrusted input and expanding containers while minimizing the number of interactions between the Defender components that can be sandboxed and those that must run with full privileges, they said.
Performance is a key concern with sandboxing antivirus tools, which simultaneously run several processes, they explained. To mitigate the risk, the team had to minimize the number of interactions between the sandboxed and privileged processes, and ensure these interactions were only done in key moments where their cost would not be significant.
The feature is now available to Windows Insiders to test in upcoming versions of Windows 10. If you are not in the program and cant wait for Microsoft to release it in full, you can force-enable Windows Defender to run in a sandbox on Windows 10 version 1703 and later.
Microsoft is looking ahead and now working on anti-tempering defenses for Windows Defender Antivirus, it reports.
Related Content:
8 Threats That Could Sink Your Company
2018 State of Cyber Workforce
DeepPhish: Simulating Malicious AI to Act Like an Adversary
3 Keys to Reducing the Threat of Ransomware

Black Hat Europe returns to London Dec 3-6 2018 with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Windows Defender: First Full Antivirus Tool to Run in a Sandbox