<![CDATA[Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot]]>Check Point Research has detailed a technique that abuses Microsoft Defender's own, legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations. The attack surface spans Windows 7 through Windows 11 25H2, and notably, no software vulnerability is exploited, nor is any external driver imported onto the target machine.

The component in question is BTR.sys (Boot Time Removal Tool), a driver that is already present and signed by Microsoft, making it a trusted part of the OS ecosystem.

  • Impact: An attacker with administrator privileges can leverage BTR.sys to delete or modify sensitive files and registry keys at boot, potentially disabling security products before the OS fully loads.
  • Affected Systems: Windows 7, Windows 8.x, Windows 10, Windows 11 (up to 25H2), and corresponding Server versions.
  • Exploitation: Requires prior admin-level access; no user interaction or external driver installation is needed.

Because the driver is Microsoft-signed, the technique effectively bypasses driver signature enforcement and persistent protection mechanisms that would normally block third-party drivers from loading. Check Point notes this is a design trade-off in the remediation tool rather than a flaw in the code itself.

Given that the driver is a standard component of Defender, the abuse vector is highly consistent across supported Windows builds.

Source: The Hacker News

Is your organization actively monitoring for unusual BTR.sys usage during boot, or have you implemented additional integrity checks on signed drivers to mitigate this type of abuse?

]]>https://xploitlk.com/topic/61/microsoft-defender-s-own-driver-can-be-weaponized-to-delete-security-software-at-bootRSS for NodeSat, 05 Sep 2026 12:37:44 GMTSun, 23 Aug 2026 06:37:36 GMT60