As cited
Copy frozen at (site build).
vulnerabilities
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point Research disclosed a technique leveraging Microsoft Defender's legitimately signed BTR.sys boot-time remediation driver to perform arbitrary kernel-level file and registry operations across Windows 7 through Windows 11 25H2. The method requires no software vulnerability or external driver, operating entirely with built-in Windows components at boot time.
Why it matters: Windows administrators and security teams need to assess whether adversaries can weaponize this driver to disable security controls or tamper with system integrity on their systems, as it exploits a legitimate Microsoft component present in all supported Windows versions.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point Research disclosed that Microsoft Defender’s signed boot‑time driver BTR.sys can be repurposed to execute arbitrary kernel‑level file and registry operations on Windows systems from Windows 7 through Windows 11 25H2. The abuse does not rely on a software vulnerability or require loading an external driver, as the legitimate driver is already present and trusted by the OS. By manipulating BTR.sys, an attacker can delete or disable security software during the early boot sequence, achieving persistence before most defenses start.
Why it matters: Windows administrators and security operations teams are affected because attackers can disable endpoint protection at boot, so they should monitor for anomalous BTR.sys activity and review driver signing policies.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point Research disclosed that Microsoft Defender’s signed boot‑time driver BTR.sys can be repurposed to execute arbitrary kernel‑level file and registry operations on Windows systems from Windows 7 through Windows 11 25H2. The abuse does not rely on a software vulnerability or require loading an external driver, as the legitimate driver is already present and trusted by the OS. By manipulating BTR.sys, an attacker can delete or disable security software during the early boot sequence, achieving persistence before most defenses start.
Why it matters: Windows administrators and security operations teams are affected because attackers can disable endpoint protection at boot, so they should monitor for anomalous BTR.sys activity and review driver signing policies.
- Source published
- First seen by Cybersecurity Tracker