Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research disclosed a technique abusing Microsoft Defender's signed boot-time remediation driver BTR.sys to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2. No software flaw was exploited, and no external driver was imported. The technique affects systems without requiring user interaction beyond standard access.