Attackers Can Weaponize Microsoft Defender Driver to Blind Security Software
Check Point Research reveals a method to repurpose a core Windows driver for kernel-level deletions during boot.
Security researchers have uncovered a method to turn Microsoft Defender's own remediation tools against the operating system. By repurposing a legitimate boot-time driver, attackers can execute kernel-level operations to delete security software before it can initialize.
Check Point Research disclosed that the Boot-Time Removal driver, known as BTR.sys, can be used as a kernel-level operation primitive. The driver is embedded as a PE resource called BOOTTIMETOOL within MpEngine.dll. By reverse-engineering the driver's proprietary transaction protocol and utilizing a hard-coded 256-byte RC4 encryption key—which has remained unchanged across 18 unique 64-bit versions since Windows 7—attackers can instruct the driver to perform arbitrary file and registry operations from Ring 0.
To execute this technique, an attacker must first obtain an administrator account with SeLoadDriverPrivilege. Once these privileges are secured, the attacker can bypass the Service Control Manager by using direct HKLM registry writes. This specific approach allows the operation to avoid triggering Windows Event ID 7045, which typically logs the installation of new services, thereby increasing the stealth of the attack.
The Architectural Blind Spot
BTR.sys was originally designed to remove malware that remains locked while Windows is running by scheduling deletions to occur immediately after a reboot. This creates a critical distinction from "Bring Your Own Vulnerable Driver" (BYOVD) attacks. While BYOVD attacks rely on third-party drivers that Microsoft can blocklist, this technique utilizes a core Windows component. Because BTR.sys is essential to Microsoft Defender's functionality, it cannot be blocked without breaking the antivirus software itself.
Implications for EDR and Defense
This technique provides a highly reliable method for neutralizing Endpoint Detection and Response (EDR) and antivirus tools. By operating in the "golden window" of the boot process using a trusted, Microsoft-signed driver, attackers can bypass Tamper Protection. This effectively blinds security teams to subsequent malicious activity by removing the very tools meant to detect it. Check Point Research noted that the issue is not a traditional vulnerability, but rather an architectural trust boundary that can be crossed once administrative privileges are obtained.
Current Status and Outlook
The technique affects a wide range of systems, spanning from Windows 7 through Windows 11 25H2. According to The Hacker News, the Microsoft Security Response Center (MSRC) confirmed that the findings do not meet the criteria for immediate servicing because the exploit relies on pre-existing administrative privileges. Security teams should monitor for unauthorized HKLM registry modifications and the unusual deployment of boot-time remediation tasks as potential indicators of compromise.