As cited
Citation snapshot as of .
vulnerabilities
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point Research disclosed a technique leveraging Microsoft Defender's legitimately signed BTR.sys boot-time remediation driver to perform arbitrary kernel-level file and registry operations across Windows 7 through Windows 11 25H2. The method requires no software vulnerability or external driver, operating entirely with built-in Windows components at boot time.
Why it matters: Windows administrators and security teams need to assess whether adversaries can weaponize this driver to disable security controls or tamper with system integrity on their systems, as it exploits a legitimate Microsoft component present in all supported Windows versions.
- Source published
- First seen by Cybersecurity Tracker