Security researchers have found that a legitimate Microsoft Defender driver can be repurposed to perform highly privileged file and Registry operations, potentially allowing attackers with existing administrator access to weaken security protections.
Check Point Research disclosed the findings on August 20, 2026, after analyzing BTR.sys, a Microsoft-signed driver used by Defender for boot-time remediation.
BTR.sys normally helps Defender remove files or make system changes that cannot be completed while Windows is fully running. For example, it can perform cleanup tasks during a reboot when a malicious file is otherwise locked or inaccessible.
Researchers found that the driver’s built-in capabilities can also be redirected for unintended purposes.
After reverse engineering its undocumented configuration system, Check Point demonstrated that BTR.sys can be instructed to delete or move files and modify the Windows Registry while operating with kernel-level privileges — one of the highest levels of access in Windows.
Why the Finding Matters
The technique is different from a typical Bring Your Own Vulnerable Driver (BYOVD) attack.
In BYOVD attacks, threat actors usually load an older or flawed signed driver and exploit a security vulnerability within it. BTR.sys, however, is a legitimate Microsoft component, and the research does not rely on exploiting a traditional software bug.
Instead, attackers could potentially misuse functionality that already exists for legitimate Defender remediation.
Check Point also found that BTR.sys can run early during Windows startup, before some higher-level security services have fully initialized. Researchers described this period as a “golden window” because it could allow certain security components to be modified before the complete protection stack is active.
In controlled testing, the researchers demonstrated that the technique could interfere with Microsoft Defender components.
Important Limitations
The findings do not mean an attacker can remotely disable Defender on any Windows computer.
An attacker would already need significant administrative privileges and the ability to load a kernel driver. This makes BTR.sys abuse primarily a post-compromise technique that could be used after an attacker has already gained powerful access to a system.
According to Check Point, Microsoft Security Response Center determined that the research did not meet its criteria for immediate servicing because the technique depends on those pre-existing privileges. There’s been no evidence that cyberattacks are currently using the technique in real-world attacks.
Because BTR.sys is legitimately signed by Microsoft, security teams may need to focus on unusual driver activity and suspicious system changes rather than relying only on signatures or blocklists. Even trusted software can become useful to attackers when powerful legitimate features are used outside their intended purpose.
Leave a Reply