Back Feeds.4Sysops

Microsoft Defender’s signed BTR.sys driver can erase security tools at boot

Feeds.4Sysops •IT News • August 21, 2026

A Microsoft-signed driver built into Defender can be repurposed to remove antivirus and EDR components before they start, giving attackers with administrator-level privileges a powerful boot-time evasion technique. Check Point Research says the approach works from Windows 7 through Windows 11 25H2, bypasses common driver-blocking controls, and is not currently linked to real-world attacks. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Abuse of Microsoft Defender Driver Enables Kernel-Level Attacks Research reveals that the Microsoft Defender Boot-Time Removal driver (BTR.sys) can be weaponized to perform unauthorized file and registry operations from kernel mode. This exploitation does not rely on traditional vulnerabilities but instead leverages a trusted, signed driver, allowing attackers with administrative privileges to bypass endpoint security solutions. The Check Point research highlights how legitimate security components can be repurposed for malicious purposes, raising concerns about the security of trusted software. The findings stemmed from an incident response investigation, where initially suspicious activity was traced back to legitimate Defender operations. The research introduces BTR_CLI, a tool that can construct valid encrypted transactions to demonstrate the driver's capabilities. This incident underscores the potential for similar vulnerabilities in other signed components within the Windows ecosystem. 10 sources 67

Microsoft Defender’s signed BTR.sys driver can erase security tools at boot

The full story

Extracted Entities

Platforms (2)

Tools (1)