Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

Home / Tech / Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

August 21, 2026 dirk 0 Comments 3 tags

Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research has disclosed a technique that uses Microsoft Defender’s own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine.

The driver, BTR.sys (Boot Time Removal Tool), is a

Source: The Hacker News

Explore More

Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come

Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent

Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security

On non-rooted Android 17, ADB uninstall of system apps fails

On non-rooted Android 17, ADB uninstall of system apps fails Source: Hacker News