Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Summary: Check Point Research disclosed a technique that abuses BTR.sys, Microsoft Defender's legitimately signed boot-time remediation driver, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting any software flaw. Researcher Jiří Vinopal reverse-engineered the driver's RC4-encrypted transaction protocol, with a key hard-coded in every BTR.sys build since Windows 7, and released a proof-of-concept tool, BTR_CLI, on August 20, 2026, demonstrating deletion of the full Defender stack on a Windows 11 25H2 machine with Tamper Protection active.
Bottom line: The driver cannot be added to Microsoft's Vulnerable Driver Blocklist or blocked via WDAC without disrupting Defender itself, and Microsoft's MSRC determined the findings do not meet the criteria for immediate servicing because the technique requires pre-existing administrative privileges. Check Point found no evidence of real-world abuse, but the tool is public under the MIT license, and the driver executes in the window after the filesystem becomes writable but before Defender's user-mode services start.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026