There's nothing you're missing, it is insane. So the anti-virus runtime engine has to run as something akin to SYSTEM since it has oversight over the entire sy

There's nothing you're missing, it is insane. So the anti-virus runtime engine has to run as something akin to SYSTEM since it has oversight over the entire system, but once a type is detected it could pass the actual sandboxing into a lowpriv child process and wait for a result. The only explanation I can imagine is performance? But child processes could be pre-spawned or it could use shared memory regions for isolation. There's a number of things you can do here to have your cake and eat it too. I'm legitimately surprised by this from Microsoft, they take security very seriously these days, and I cannot see how this would pass their normal review process? Even just reading the description makes you facepalm.