A Microsoft Defender-signed driver can wipe out any antivirus at boot
Check Point Research has documented a technique that uses BTR.sys, the official Windows Defender boot-time driver, to delete system files at the kernel level—without exploiting a vulnerability, without importing an external driver.
Aug 25, 2026 8 2


