Researchers show boot-time Defender driver can remove security software

Check Point Research disclosed a technique that uses Microsoft Defender's signed BTR.sys boot-time remediation driver for kernel-level file and registry operations on Windows systems from Windows 7 through Windows 11 25H2. Its proof-of-concept tool can schedule operations at boot, including removal of Defender components before user-mode services start. The researchers said the technique requires an administrator account with SeLoadDriverPrivilege and found no evidence of real-world abuse. They said Microsoft's security response center did not consider it eligible for immediate servicing because it relies on pre-existing administrative privileges.