Security Experts:

Connect with us

Hi, what are you looking for?


Endpoint Security

Microsoft Creates Sandbox for Windows Defender

Microsoft announced on Friday that Windows Defender, the antivirus application shipped with the company’s operating systems, can now run in a sandbox, and the tech giant claims it’s the first product of its kind to have this capability.

Microsoft announced on Friday that Windows Defender, the antivirus application shipped with the company’s operating systems, can now run in a sandbox, and the tech giant claims it’s the first product of its kind to have this capability.

Microsoft has admitted that both its own employees and external researchers have identified vulnerabilities in Windows Defender, and given that it’s a program that runs with high privileges it can be an attractive target for malicious actors.

By allowing Windows Defender to run in a sandbox, Microsoft aims to increase the application’s resistance to attacks, particularly on the latest version of Windows 10, which includes significant protections and on which privilege escalation from a sandbox should be much more difficult.

Running the antivirus application in a sandbox should ensure that if it becomes compromised, the attacker’s actions are restricted and the rest of the system remains protected.

“Putting Windows Defender Antivirus in a restrictive process execution environment is a direct result of feedback that we received from the security industry and the research community,” Microsoft said in a blog post. “It was a complex undertaking: we had to carefully study the implications of such an enhancement on performance and functionality. More importantly, we had to identify high-risk areas and make sure that sandboxing did not adversely affect the level of security we have been providing.”

In order to build a sandbox for Windows Defender, Microsoft said it had to overcome several challenges.

The company has created two layers: one for components that can be sandbox and one for components that require full privileges on the system. In order to avoid a negative impact on performance, interaction between these layers needs to be minimal and it needs to take place at key moments.

Microsoft also had to figure out a way to reduce the usage of resources while ensuring that the level of security provided by Windows Defender is not decreased.

The sandboxing feature will be rolled out gradually to insiders running Windows 10 version 1703 or later. Users can also manually enable it by setting a certain environment variable (setx /M MP_FORCE_USE_SANDBOX 1).

The company is encouraging members of the community to test out the new sandboxed Windows Defender and provide feedback. Microsoft says it’s already working on additional anti-tampering mechanisms for Windows Defender.

Related: Microsoft Launches Windows Defender Extension for Chrome

Related: Windows Defender ATP Detects Spyware Used by Law Enforcement

Related: Microsoft Brings Windows Defender ATP to Windows 7, 8.1

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...

Management & Strategy

Tens of cybersecurity companies have announced cutting staff over the past year, in some cases significant portions of their global workforce.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.


CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.