Microsoft Defenders Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research has disclosed a technique that uses Microsoft Defenders own legitimately signed boottime remediation driver to perform arbitrary kernellevel file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2 with no software flaw exploited and no driver imported from outside the machine The driver BTRsys Boot Time Removal Tool is a