I can't speak to the exact implementation here, but you can just run specific components as system, and then the dangerous stuff (parsers, decompression, possib

I can't speak to the exact implementation here, but you can just run specific components as system, and then the dangerous stuff (parsers, decompression, possibly emulation) as unprivileged. Here's one approach. https://blog.trailofbits.com/2017/08/02/microsoft-didnt-sandbox-windows-defender-so-i-did/ https://blog.trailofbits.com/2017/08/02/microsoft-didnt-sand...