<story><title>Microsoft Sandboxes Windows Defender</title><url>https://www.bleepingcomputer.com/news/microsoft/microsoft-sandboxes-windows-defender/</url></story><parent_chain><item><author>youdontknowtho</author><text>I know that sandboxing is desirable here, but it runs as SYSTEM. How do you sandbox something running as SYSTEM? They must have changed the identity of Defender. That&amp;#x27;s all I can come up with. Anyone else know how this works?</text></item></parent_chain><comment><author>staticassertion</author><text>I can&amp;#x27;t speak to the exact implementation here, but you can just run specific components as system, and then the dangerous stuff (parsers, decompression, possibly emulation) as unprivileged.&lt;p&gt;Here&amp;#x27;s one approach.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.trailofbits.com&amp;#x2F;2017&amp;#x2F;08&amp;#x2F;02&amp;#x2F;microsoft-didnt-sandbox-windows-defender-so-i-did&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.trailofbits.com&amp;#x2F;2017&amp;#x2F;08&amp;#x2F;02&amp;#x2F;microsoft-didnt-sand...&lt;/a&gt;</text></comment>
<story><title>Microsoft Sandboxes Windows Defender</title><url>https://www.bleepingcomputer.com/news/microsoft/microsoft-sandboxes-windows-defender/</url></story><parent_chain><item><author>youdontknowtho</author><text>I know that sandboxing is desirable here, but it runs as SYSTEM. How do you sandbox something running as SYSTEM? They must have changed the identity of Defender. That&amp;#x27;s all I can come up with. Anyone else know how this works?</text></item></parent_chain><comment><author>userbinator</author><text>I believe it runs with even higher privileges than SYSTEM --- a while ago I had to deal with an unresponsive and 100%-CPU-consuming scanner process, which I tried to kill it from a command prompt running as SYSTEM, and it still said &amp;quot;access denied&amp;quot;.&lt;p&gt;I know the reasoning is &amp;quot;if SYSTEM can kill it then so can malware&amp;quot;, but still a bit unsettling that there&amp;#x27;s processes running on your system that even the owner doesn&amp;#x27;t have privilege to control.</text></comment>