[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fn5uDLe0-V4hMhRzbEwyHmxZSv8XyWuCeRhnG9Fufcvg":3},{"article":4,"iocs":55,"watch_terms":61,"solutions":62,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"2e2506ff-fe9a-4f8a-be0c-227a79e06727","Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot","microsoft-defender-s-own-driver-can-be-weaponized-to-delete-security-software-at-befbe5","Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine. The driver, BTR.sys (Boot Time Removal Tool), is a","Check Point Research has discovered a technique that leverages Microsoft Defender's legitimate BTR.sys driver to perform kernel-level file and registry operations on Windows systems. This driver, embedded within Defender, can be used to delete security software, including Defender itself, during the boot process before user-mode services are active. The technique requires administrator privileges and does not exploit a software flaw, but rather an architectural trust boundary.","Microsoft Defender's BTR.sys driver can be weaponized to delete security software at boot.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fmicrosoft-defenders-own-driver-can-be.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiCbsmb6Wk8pQKWQmByAl5wnZQEVjS7ZYiHrlsHRM7VlcoPL7s30TaoTReoaQ4LI8Oy3KfKlIRHn9sN_7bjEKd_FWPHi1V0JR6LERepKBWSdJOk6cSUNgfIN2KVc6ydfbTILTy11owREYfpO7K11gFQV00l6qf1zl5rzF28jPhcN744yTvRAA-EjyDSBXs\u002Fs1600\u002Fwindows.jpg","2026-08-21T15:52:10+00:00","2026-08-21T18:00:17.54283+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"Microsoft Defender","product",{"name":21,"type":19},"BTR.sys",{"name":23,"type":19},"BTR_CLI",{"name":25,"type":26},"Microsoft","vendor",{"name":28,"type":26},"Check Point Research",{"name":30,"type":31},"Windows","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,59],{"type":57,"value":21,"context":58},"malware","Boot Time Removal Tool driver used in the discovered technique.",{"type":57,"value":23,"context":60},"Proof-of-concept tool developed by Check Point Research to demonstrate the BTR.sys technique.",[25,28,18],{"controls":63,"vendors":149},[64,92,121],{"slug":65,"name":66,"problem":67,"products":68},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[69,77,84],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":65,"product_name":81,"url":82,"description":83},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":93,"name":94,"problem":95,"products":96},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":122,"name":123,"problem":124,"products":125},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[126,134,141],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":135,"vendor_name":25,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",[150,156],{"slug":151,"name":152,"logo_path":153,"roles":154},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[155],"reported_by",{"slug":135,"name":25,"logo_path":136,"roles":157},[158],"affected",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":174},"microsoft-defenders-btrsys-driver-abused-to-kill-security-tools-at-boot","Microsoft Defender's BTR.sys Driver Abused to Kill Security Tools at Boot","Check Point Research revealed that Microsoft Defender's legitimate kernel-level driver (BTR.sys) can be weaponized by an attacker with administrator privileges to delete security software — including Defender itself — before user-mode protections are active during system boot. This is not a traditional software vulnerability but an architectural trust boundary abuse, meaning no patch will immediately resolve the risk. The technique highlights a dangerous assumption: that trusted, signed system components are inherently safe from misuse by privileged insiders or compromised accounts. This matters because it effectively allows an attacker to blind an endpoint's defenses at the kernel level, leaving the system exposed for subsequent payloads. Organizations relying solely on endpoint security software as a last line of defense must reconsider their layered security assumptions.",[164,165,166,167,168,169,170,171,172,173],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 10 – Malware Defenses","CIS Control 13 – Data Protection","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AU-12 – Audit Record Generation","NIST SP 800-53 CM-7 – Least Functionality","MITRE ATT&CK T1562.001 – Impair Defenses: Disable or Modify Tools","MITRE ATT&CK T1014 – Rootkit","NIST Cybersecurity Framework PR.AC-4 – Access Permissions and Authorizations",{}]