Abuse of Microsoft Defender Driver Enables Kernel-Level Attacks

• •BTR.sys can be exploited to perform kernel-level operations without traditional vulnerabilities.
• •Attackers can neutralize endpoint security by leveraging a trusted Microsoft-signed driver.
• •The research introduces BTR_CLI, a tool for demonstrating the driver's malicious capabilities.

Research reveals that the Microsoft Defender Boot-Time Removal driver (BTR.sys) can be weaponized to perform unauthorized file and registry operations from kernel mode. This exploitation does not rely on traditional vulnerabilities but instead leverages a trusted, signed driver, allowing attackers with administrative privileges to bypass endpoint security solutions. The Check Point research highlights how legitimate security components can be repurposed for malicious purposes, raising concerns about the security of trusted software. The findings stemmed from an incident response investigation, where initially suspicious activity was traced back to legitimate Defender operations. The research introduces BTR_CLI, a tool that can construct valid encrypted transactions to demonstrate the driver's capabilities. This incident underscores the potential for similar vulnerabilities in other signed components within the Windows ecosystem.