Windows Defender Driver Abuse Enables Kernel

Gbhackers •Divya • August 21, 2026

Security researcher Jiří Vinopal has published a detailed analysis of BTR.sys, the Microsoft Defender Boot-Time Removal driver. His research reveals how this legitimate, Microsoft-signed component can be exploited to perform file and registry operations under attacker control from kernel mode. This study, titled “BTR Reforged,” does not rely on traditional memory-corruption vulnerabilities or the Bring […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Abuse of Microsoft Defender Driver Enables Kernel-Level Attacks Research reveals that the Microsoft Defender Boot-Time Removal driver (BTR.sys) can be weaponized to perform unauthorized file and registry operations from kernel mode. This exploitation does not rely on traditional vulnerabilities but instead leverages a trusted, signed driver, allowing attackers with administrative privileges to bypass endpoint security solutions. The Check Point research highlights how legitimate security components can be repurposed for malicious purposes, raising concerns about the security of trusted software. The findings stemmed from an incident response investigation, where initially suspicious activity was traced back to legitimate Defender operations. The research introduces BTR_CLI, a tool that can construct valid encrypted transactions to demonstrate the driver's capabilities. This incident underscores the potential for similar vulnerabilities in other signed components within the Windows ecosystem. 8 sources 67

Windows Defender Driver Abuse Enables Kernel

The full story

Extracted Entities

MITRE ATT&CK (2)

Platforms (2)