Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine. The driver, BTR.sys (Boot Time Removal Tool), is a

Report fact: Check Point Research describes a technique that abuses Microsoft Defender’s legitimately signed boot-time remediation driver (BTR.sys) to perform arbitrary kernel-level file and registry operations, including deleting security software at boot, on Windows 7 through Windows 11 25H2, without exploiting a software flaw or importing an external driver. Report fact: Because the capability is built into a trusted, signed component, it can be repurposed by an attacker already on the system to neutralize defensive tools early in the boot process. RealGround analysis: This highlights an AI-adjacent supply chain and platform risk, where trusted security components and remediation tooling can be weaponized and should be inventoried and governed similarly to AI and automation frameworks. RealGround analysis: Organizations should treat such privileged remediation drivers and automated security tooling as part of their broader supply chain and SBOM posture, ensuring configuration hardening, monitoring of driver abuse patterns, and readiness assessments for scenarios where built-in security components are turned against the environment.