Check Point Finds a Signed Windows Kernel Abuse Path
Check Point Research says Microsoft Defender’s Boot-Time Removal driver, BTR.sys, can be repurposed as a signed kernel operation primitive. The team reverse-engineered the driver, mapped its transaction format, and built BTR_CLI to show how valid-looking inputs can make it carry out file and registry changes from Ring 0.
The abuse works because the driver is a legitimate Microsoft-signed component built into Windows, so the system treats its actions as trusted remediation instead of suspicious driver loading. That means the usual defenses aimed at unsigned or known-bad drivers, including vulnerable-driver blocklists, do not catch this path; the same trust can be used to disable security tools.
For defenders, the story sits in the trust model, not in one broken binary. Any endpoint stack that assumes built-in remediation components are inherently safe can inherit a kernel-level bypass route even when its vulnerable-driver list is current.