Microsoft didn’t sandbox Windows Defender, so I did

Published

2017-08-02 10:50

Collected

2026-07-03 05:23

---
id: 2065
title: "Microsoft didn’t sandbox Windows Defender, so I did"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2017/08/02/microsoft-didnt-sandbox-windows-defender-so-i-did/"
published_at: "2017-08-02T10:50:55Z"
tags: ["vulnerability-research", "rust", "sandboxing", "windows", "trail-of-bits", "windows-defender", "appcontainer"]
phying_url: "https://phying.com/item/2065"
lang: en
---

# Microsoft didn’t sandbox Windows Defender, so I did

## Summary

A Trail of Bits researcher released Flying Sandbox Monster, a Rust framework sandboxing Windows Defender's MsMpEng in AppContainers, arguing Microsoft left this high-privilege surface unprotected.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2017-08-02T10:50:55Z
- **Original:** https://blog.trailofbits.com/2017/08/02/microsoft-didnt-sandbox-windows-defender-so-i-did/
- **Phying News:** https://phying.com/item/2065