Microsoft Defender's Own Driver Turned into a Weapon Against Security Software

Check Point Research has disclosed a technique that makes it possible to abuse a legitimate, Microsoft-signed driver belonging to Windows Defender itself for arbitrary file and registry operations at the kernel level. The method works on systems from Windows 7 through Windows 11 25H2 and does not exploit a single software vulnerability: no foreign driver is dropped onto the machine.

The driver in question is BTR.sys (Boot Time Removal Tool) — a mandatory Windows component that Defender uses to finish cleaning up malware after a reboot: to delete files and registry entries that were locked while the system was running. Precisely because it is a built-in component, it cannot be added to Microsoft's vulnerable driver blocklist or blocked through Windows Defender Application Control — otherwise Defender itself would stop working.

How it works

Researcher Jiří Vinopal presented the finding at Black Hat USA 2026 and DEF CON 34, and on August 20, 2026 he published an article and a proof-of-concept called BTR_CLI. He reverse-engineered the driver's undocumented transactional protocol and discovered that every configuration block passed to it is encrypted with RC4 using a 256-byte key hardcoded into the code. The key had not changed across all 18 of the 64-bit builds he checked, going back to Windows 7.

BTR_CLI extracts BTR.sys from the MpEngine.dll library, assembles a valid encrypted transaction, and installs the driver as a service by writing directly to the registry, bypassing the Service Control Manager. As a result, no familiar service-install event record (Event ID 7045) is generated. Once loaded, the driver carries out operations from Ring 0 under the identity of the system process (PID 4): it deletes locked files, moves files into System32\drivers, and edits the registry.

The deferred-launch mode is especially dangerous. The driver fires during a “golden window” — the interval when the file system is already writable but Defender's user-mode services have not yet started and had no chance to lock themselves. In the demonstration, BTR_CLI cleanly wiped out the entire Defender stack on a fully updated Windows 11 25H2 with tamper protection enabled.

Microsoft's response

The attack requires administrator rights with the SeLoadDriverPrivilege privilege. That is exactly why Microsoft, according to the researchers, does not consider this a vulnerability requiring an urgent fix: it is more of an architectural trust boundary that can be crossed by someone who already holds administrative rights. The BTR_CLI repository states outright that no patch is planned — though Microsoft has not confirmed this publicly.

Check Point stresses that no traces of the technique being used in real-world attacks have been found, so defensive measures can be worked out in advance. The company has published a set of Sysmon-based indicators and advises restricting the granting of the SeLoadDriverPrivilege privilege first and foremost. A curious detail: the entire investigation began with the analysis of an incident in which suspicious telemetry ultimately turned out to be perfectly legitimate work by Defender itself.

Source: The Hacker News