Vulnerabilities · 52 days ago
Check Point Research says Microsoft Defender’s Boot-Time Removal driver, BTR.sys, can be repurposed as a signed kernel operation primitive. The team reverse-engineered the driver, mapped its transaction format, and built BTR_CLI to show how valid-looking inputs can make it carry out file and registry changes from Ring 0.
The abuse works because the driver is a legitimate Microsoft-signed component built into Windows, so the system treats its actions as trusted remediation instead of suspicious driver loading. That means the usual defenses aimed at unsigned or known-bad drivers, including vulnerable-driver blocklists, do not catch this path; the same trust can be used to disable security tools.
For defenders, the story sits in the trust model, not in one broken binary. Any endpoint stack that assumes built-in remediation components are inherently safe can inherit a kernel-level bypass route even when its vulnerable-driver list is current.
2 sources covering this story
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
BTR Reforged uses Defender's signed BTR.sys with an administrator account and SeLoadDriverPrivilege for kernel file and registry operations.
What if a signed Microsoft remediation driver could be instructed to execute arbitrary file and registry operations from Ring 0 – without exploits, vulnerabilities, or memory corruption?
Part of the PlainSec briefing for 2026-08-24