Windows Defender Driver Exposed as Kernel‑Level Weapon

Microsoft Defender includes a signed kernel‑level driver called BTR.sys (Boot Time Removal Tool). A recent Check Point Research analysis shows that the driver can be abused to perform arbitrary file and registry operations during system startup on Windows 7 through Windows 11 25H2, without relying on an outside vulnerability or importing code from another machine¹.

The exploitation works by injecting malicious payloads into the driver's context before it loads. Because BTR is trusted by the operating system, the injected code runs with elevated privileges, allowing attackers to delete other security software or modify critical settings while bypassing user account controls¹.

BTR was originally designed to clean up remnants of previous antivirus installations after failed updates. The same design intent makes it attractive for abuse when attackers gain initial foothold in a network; they can then use lateral movement techniques to reach the driver and execute their payloads².

This discovery underscores that even components distributed by major vendors can become attack vectors if their internal surfaces are not fully protected against privilege escalation.