Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 797216" data-attributes="member: 32260">AppContainer sandbox is based on isolation, but not on virtualization. It is intended to isolate the applications via: Credential Isolation, Device Isolation, File Isolation, Network Isolation, Process Isolation, Window Isolation:<a href="https://docs.microsoft.com/en-us/windows/desktop/secauthz/appcontainer-isolation" target="_blank">AppContainer Isolation - Windows applications</a><a href="https://scorpiosoftware.net/tag/windowsinternals/" target="_blank">WindowsInternals – Pavel&#039;s Blog</a>The standard desktop applications cannot run in AppContainer, but can be adapted to do it.Application in AppContainer can create child AppContainers to run processes with different capabilities.<a href="https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Ding-Cutting-Edge-Microsoft-Browser-Security-From-People-Who-Owned-It-wp.pdf" target="_blank">https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Ding-Cutting-Edge-Microsoft-Browser-Security-From-People-Who-Owned-It-wp.pdf</a>Capabilities define what is allowed to do by the application, outside of AppContainer sandbox. If the application requires to do something with higher (than Low) privileges, then it has to run a Broker.AppContainer capabilities can be configured partially by external tools like:<a href="https://github.com/M2Team/Privexec" target="_blank">M2Team/Privexec</a>There is a thread about it:<a href="https://www.wilderssecurity.com/threads/privexec-run-the-program-with-the-specified-permission-level.410734/#post-2800772" target="_blank">Privexec - Run the program with the specified permission level</a></blockquote>

[QUOTE="Andy Ful, post: 797216, member: 32260"] AppContainer sandbox is based on isolation, but not on virtualization. It is intended to isolate the applications via: Credential Isolation, Device Isolation, File Isolation, Network Isolation, Process Isolation, Window Isolation: [URL='https://docs.microsoft.com/en-us/windows/desktop/secauthz/appcontainer-isolation']AppContainer Isolation - Windows applications[/URL] [URL='https://scorpiosoftware.net/tag/windowsinternals/']WindowsInternals – Pavel's Blog[/URL] The standard desktop applications cannot run in AppContainer, but can be adapted to do it. Application in AppContainer can create child AppContainers to run processes with different capabilities. [URL]https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Ding-Cutting-Edge-Microsoft-Browser-Security-From-People-Who-Owned-It-wp.pdf[/URL] Capabilities define what is allowed to do by the application, outside of AppContainer sandbox. If the application requires to do something with higher (than Low) privileges, then it has to run a Broker. AppContainer capabilities can be configured partially by external tools like: [URL='https://github.com/M2Team/Privexec']M2Team/Privexec[/URL] There is a thread about it: [URL='https://www.wilderssecurity.com/threads/privexec-run-the-program-with-the-specified-permission-level.410734/#post-2800772']Privexec - Run the program with the specified permission level[/URL] [/QUOTE]

Verification