Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research has disclosed a technique that uses Microsoft Defender’s own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine.The driver, BTR.sys (Boot Time Removal Tool), is a

First seen on thehackernews.com

Jump to article: thehackernews.com/2026/08/microsoft-defenders-own-driver-can-be.html