Microsoft Defender Driver Can Be Weaponized to Disable EDR and AV From Windows Kernel

Cybersecuritynews •Guru Baran • August 20, 2026

Microsoft Defender’s legitimate Boot-Time Removal (BTR.sys) driver can be repurposed to perform powerful kernel-level file and registry operations, potentially enabling attackers with administrative privileges to neutralize endpoint security protections. The Check Point research does not describe a conventional vulnerability or memory-corruption flaw; instead, it exposes how a trusted, Microsoft-signed remediation component can become a Living-off-the-Land […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Abuse of Microsoft Defender Driver Enables Kernel-Level Attacks Research reveals that the Microsoft Defender Boot-Time Removal driver (BTR.sys) can be weaponized to perform unauthorized file and registry operations from kernel mode. This exploitation does not rely on traditional vulnerabilities but instead leverages a trusted, signed driver, allowing attackers with administrative privileges to bypass endpoint security solutions. The Check Point research highlights how legitimate security components can be repurposed for malicious purposes, raising concerns about the security of trusted software. The findings stemmed from an incident response investigation, where initially suspicious activity was traced back to legitimate Defender operations. The research introduces BTR_CLI, a tool that can construct valid encrypted transactions to demonstrate the driver's capabilities. This incident underscores the potential for similar vulnerabilities in other signed components within the Windows ecosystem. 10 sources 67

Microsoft Defender Driver Can Be Weaponized to Disable EDR and AV From Windows Kernel

The full story

Extracted Entities

Platforms (2)

Tools (2)