The sandboxing required a number of fundamental changes. Microsoft could no longer assume that Defender Antivirus had full system access, and minimized IO to avoid leaving the sandbox whenever possible. Most protection info is stored in memory-mapped files that are read-only on launch, and the actual content processes have very limited access. It’s not certain …
Continue reading “Windows’ built-in antivirus tool can run in a secure sandbox”