[wizzwizz4]

> Where's Windows containerization at?

Doesn't exist. Not even UAC is a reliable security boundary. Likely, it will never exist.

> Is there any other approach which would allow for "non-white-listed applications" to run containerized and "see the Scarecrow artifacts",

Sounds a bit like WoW64. It should be easy enough to replicate this behaviour with a rootkit. However, the software would always be able to peek behind the curtain.

> In other words, the attacker is a healthy young cat chasing a tired old mouse.

I always thought of the attackers as the mice, and anti-malware folk as the cats.