Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research revealed that Microsoft Defender's legitimate kernel-level driver (BTR.sys) can be weaponized by an attacker with administrator privileges to delete security software — including Defender itself — before user-mode protections are active during system boot. This is not a traditional software vulnerability but an architectural trust boundary abuse, meaning no patch will immediately resolve the risk. The technique highlights a dangerous assumption: that trusted, signed system components are inherently safe from misuse by privileged insiders or compromised accounts. This matters because it effectively allows an attacker to blind an endpoint's defenses at the kernel level, leaving the system exposed for subsequent payloads. Organizations relying solely on endpoint security software as a last line of defense must reconsider their layered security assumptions.