Reply to thread

Message

<blockquote data-quote="Eddie Morra" data-source="post: 778220">About the above comments...1. Windows was designed for administrators to make changes and as such, overrule things like security configurations. This means that administrators can enable and disable Windows Defender/Firewall, or modify the configuration. Therefore, malware running with administrative rights has and always will be able to overrule Windows Defender, the same way it has more opportunity to attack third-party AVs on the machine.2. The sandbox container which was implemented into Windows Defender was never supposed to do anything in regards to preventing Windows Defender from being disabled by software running with administrative rights on the environment. It was implemented to help restrict malicious code being executed under the context of Windows Defender processes which are under the sandbox container post-exploitation to prevent the attackers from being able to do as much as they could before whilst masking the operations as being from Windows Defender&#039;s compromised process/es. Furthermore, I imagine it also uses exploit mitigation techniques more aggressively/effectively to make old exploits fail until updated and new future vulnerabilities possibly harder to exploit.</blockquote>

[QUOTE="Eddie Morra, post: 778220"] About the above comments... 1. Windows was designed for administrators to make changes and as such, overrule things like security configurations. This means that administrators can enable and disable Windows Defender/Firewall, or modify the configuration. Therefore, malware running with administrative rights has and always will be able to overrule Windows Defender, the same way it has more opportunity to attack third-party AVs on the machine. 2. The sandbox container which was implemented into Windows Defender was never supposed to do anything in regards to preventing Windows Defender from being disabled by software running with administrative rights on the environment. It was implemented to help restrict malicious code being executed under the context of Windows Defender processes which are under the sandbox container post-exploitation to prevent the attackers from being able to do as much as they could before whilst masking the operations as being from Windows Defender's compromised process/es. Furthermore, I imagine it also uses exploit mitigation techniques more aggressively/effectively to make old exploits fail until updated and new future vulnerabilities possibly harder to exploit. [/QUOTE]

Verification