Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

Home / Tech / Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

August 21, 2026 dirk 0 Comments 3 tags

Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research has disclosed a technique that uses Microsoft Defender’s own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine.

The driver, BTR.sys (Boot Time Removal Tool), is a

Source: The Hacker News

Explore More

Abandoned and Little-Known Airfields

Abandoned and Little-Known Airfields Source: Hacker News

Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller

Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user

Typing Speed Test, but for Developers

Typing Speed Test, but for Developers Source: Hacker News