Microsoft turns Defender’s own driver into file-wiper for Windows 7 through 11
Check Point Research has shown how attackers with admin rights can repurpose Microsoft Defender’s built-in BTR.sys driver to delete locked endpoint security files and registry keys before they load, even on fully patched Windows 11 25H2 systems with Tamper…
Source: The Hacker News · August 22, 2026 at 12:31 AM · AI-assisted report
Single-sourceKUALA LUMPUR, 22 AUGUST 2026 —
Listen to this article
DomainFork Audio · read aloud
Check Point Research has shown how attackers with admin rights can repurpose Microsoft Defender’s built-in BTR.sys driver to delete locked endpoint security files and registry keys before they load, even on fully patched Windows 11 25H2 systems with Tamper Protection active.
Market Impact
The technique, demonstrated at Black Hat USA 2026 and DEF CON 34 on August 20, 2026, abuses the Boot Time Removal Tool—signed by Microsoft and embedded in every Windows installation from version 7 onward—to wipe security software from the kernel during the post-reboot “golden window.” Check Point said it found no evidence the method has been used in real-world attacks.
BTR.sys is delivered inside Defender’s MpEngine.dll as the BOOTTIMETOOL resource and activated when Defender must finish removing malware after a reboot. Jiří Vinopal, the Check Point threat researcher who reverse-engineered the driver, found every configuration blob is RC4-encrypted with a 256-byte key hard-coded in the .rdata section of every BTR.sys build shipped since Windows 7.
The proof-of-concept tool BTR_CLI extracts the embedded BTR.sys binary, installs it as a service via direct registry writes, bypasses the Service Control Manager and omits the usual Windows Event ID 7045 entry. When the driver loads at Ring 0 under the System process, it can delete locked files, relocate executables to unconstrained paths such as System32\drivers, delete or insert registry keys and values, and schedule the same operations for the next reboot.
A live demo removed the entire Defender stack on a fully updated Windows 11 25H2 machine despite Tamper Protection being enabled. Exploitation requires an administrator account with the SeLoadDriverPrivilege, which BTR_CLI auto-enables for accounts that already possess it.
Microsoft’s Security Response Center told Check Point the findings do not meet the immediate-servicing criteria because the technique depends on pre-existing administrative privileges. “The issue is not a vulnerability in the traditional sense, but rather an architectural trust boundary that can be crossed if an attacker already has administrative privileges,” the company said in a paper accompanying the release.
BTR.sys was previously examined in February 2021 when SentinelLabs researcher Kasif Dekel disclosed CVE-2021-24092, a privilege-escalation flaw allowing a non-admin to overwrite arbitrary files via a hard link. Microsoft patched CVE-2021-24092 on February 9, 2021.
Check Point said the research originated during an incident response when suspicious endpoint telemetry was traced to legitimate Defender remediation activity. The company has published Sysmon and Windows event indicators to help defenders spot potential abuse and recommends restricting assignment of SeLoadDriverPrivilege as the primary hardening control.
BTR_CLI is available under the MIT license on GitHub with prebuilt x64 and x86 binaries. Microsoft and Check Point Research did not respond to requests for comment before publication.
Related: Microsoft