Microsoft Defender Driver Exploited for Kernel-Level Attacks

Research reveals that the Microsoft Defender Boot-Time Removal driver (BTR.sys) can be weaponized to execute arbitrary file and registry operations at the kernel level. This capability allows attackers with administrative privileges to disable endpoint security solutions without exploiting traditional vulnerabilities. The Check Point study highlights how this legitimate Microsoft-signed driver can be transformed into a tool for bypassing security measures. The research was initiated during an incident response investigation where legitimate Defender activity was misidentified as malicious. The findings raise concerns about the potential for similar abuses in other trusted components within Windows. No specific CVEs were identified, and the attack method does not rely on conventional exploitation techniques. This situation emphasizes the need for heightened scrutiny of trusted security components.

Key Points: • BTR.sys can be weaponized to perform kernel-level operations by attackers. • No traditional vulnerabilities or exploits are involved in this attack method. • The research highlights risks associated with trusted security components.