Check Point Research has uncovered a technique allowing attackers to weaponize a legitimate Microsoft Defender driver to delete security software and perform arbitrary kernel-level operations across Windows 7 through Windows 11 25H2. The exploit requires no software vulnerability and no external driver installation, making it a supply-chain independent attack vector that operates at Windows boot time.
The driver in question, BTR.sys (Boot Time Removal Tool), ships as part of Microsoft Defender's standard remediation toolkit. This component runs with kernel privileges during system startup, granting it broad access to file and registry operations. Attackers can invoke BTR.sys through legitimate Windows mechanisms, bypassing traditional security controls that typically block unauthorized kernel access.
The technique represents a living-off-the-land approach, leveraging existing system components rather than deploying malware. An attacker with local system access or administrative credentials could trigger BTR.sys to remove competing security software, system logging tools, or forensic artifacts before the operating system fully boots. This window of opportunity occurs before endpoint detection and response (EDR) platforms initialize their kernel drivers and monitoring hooks.
The attack chain does not require exploiting a specific CVE or zero-day vulnerability in BTR.sys itself. Instead, the driver's intended functionality, combined with Windows boot sequence mechanics, creates the attack surface. Check Point researchers demonstrated the technique functions reliably across multiple Windows versions, indicating the issue spans years of Windows releases and remains present in the latest version, Windows 11 25H2.
Organizations running Microsoft Defender as their primary security solution face direct exposure. Even those using Defender alongside third-party EDR tools could see those additional security layers removed if an attacker gains initial access. The attack proves particularly effective in scenarios where an insider threat, compromised administrative account, or successful lateral movement has established local system access.
Microsoft Defender's privileged boot driver is designed to remediate infections that persist across restarts by deleting malicious files at startup. This capability, while intended for defensive purposes, becomes a liability when an attacker gains the ability to issue arbitrary commands to a legitimately signed kernel component.
Mitigation options include disabling or restricting BTR.sys execution through Group Policy or boot configuration options, though this may reduce Microsoft Defender's ability to perform boot-time remediation against actual malware. Organizations should consider implementing Secure Boot with proper firmware configuration and UEFI access controls to prevent unauthorized kernel-level operations. Restricting local administrative access limits the attack surface, as does implementing credential guard and application whitelisting.
The disclosure highlights a broader security principle: every privileged component, even those intended for defense, can become an attack vector if adversaries control the calling mechanism. Microsoft has not yet released a patch addressing this technique, though the company may determine the issue falls outside traditional security boundary definitions since it requires pre-existing system access to exploit.
For defenders, this finding emphasizes the need for layered security architectures where no single component controls system integrity unilaterally. Boot-level security mechanisms require additional verification mechanisms beyond driver signature validation alone.