Installer beware
Hard to read that Microsoft summary of the 'incident' with all of the 'look how fantastic MS Win Def ATP was'. But it does state:
> "The malicious MSI file was installed silently as part of a set of font packages; it was mixed in with other legitimate MSI files downloaded by the app during installation."
Wondered if there was a CVE for this or if there's other mitigation not mentioned - silent download and installation of an unsigned MSI file during signed app installation. That seems a much bigger problem to solve than waxing lyrical about how good your AV product is.
Biting the hand that feeds IT
