Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.
Check Point Research disclosed BTR Reforged, a technique that abuses BTR.sys, a legitimately signed Windows Defender boot-time remediation driver, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting a software flaw. The BTR_CLI proof-of-concept tool, presented at Black Hat USA 2026 and DEF CON 34, installs the driver via direct registry writes and executes deletions during the boot-time 'golden window' before Defender's user-mode services start, demonstrated by deleting the full Defender stack on a patched Windows 11 machine. Exploitation requires SeLoadDriverPrivilege; Microsoft confirmed it does not meet criteria for immediate servicing and no patch is planned. No evidence of real-world abuse was found, and related indicators of compromise via Sysmon events were published.
- Uses legitimately signed BTR.sys driver already embedded in every Windows install
- Bypasses Service Control Manager and event logging via direct registry writes
- Deletes locked files and Defender binaries during boot golden window
- Requires SeLoadDriverPrivilege; no patch planned by Microsoft
- No evidence found of the technique used in real-world attacks
- CVEs
- CVE-2021-24092
- ATT&CK
- T1543.003 Windows Service: Windows Service Registry ModificationT1562.001 Impair Defenses: Disable or Modify ToolsT1068 Exploitation for Privilege EscalationT1070.006 Indicator Removal: Timestomp
- Products
- Microsoft DefenderWindowsBTR.sys
- Threat actors
- FIN7
- Malware
- AvNeutralizer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-24092 | Microsoft Defender Elevation of Privilege Vulnerability | 7.8 | <1% |
From the original article
4 min read at thehackernews.com
Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine. The driver, BTR.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.