Check Point Research revealed that Microsoft Defender’s legitimately signed BTR.sys boot-time remediation driver can be abused for arbitrary kernel-level file and registry operations on Windows from Windows 7 through Windows 11 25H2. The technique, demonstrated with the BTR_CLI proof-of-concept, can remove security binaries in a “golden window” after reboot, while Check Point says it has seen no evidence of real-world abuse yet. #BTRsys #BTR_CLI #MicrosoftDefender #CheckPointResearch
Keypoints
- Check Point Research disclosed abuse of Microsoft Defender’s built-in BTR.sys driver.
- The technique enables arbitrary kernel-level file and registry operations on Windows.
- BTR.sys is a required Defender component and cannot be easily blocklisted without breaking Defender.
- BTR_CLI exploits an undocumented protocol and can bypass Service Control Manager installation logging.
- Check Point recommends restricting SeLoadDriverPrivilege as the main defense.
Read More: https://thehackernews.com/2026/08/microsoft-defenders-own-driver-can-be.html