A Microsoft Defender-signed driver can wipe out any antivirus at boot

Check Point Research has documented a technique that uses BTR.sys, the official Windows Defender boot-time driver, to delete system files at the kernel level—without exploiting a vulnerability, without importing an external driver.

What's happening

No CVE. No patch expected. Check Point Research has documented a technique—informally dubbed “Defender-driver abuse”—that exploits a legitimate Windows component to disable third-party security tools at reboot.

The culprit: BTR.sys (Boot Time Removal Tool). This driver, signed by Microsoft, has been bundled with Windows Defender since Windows 7. Its official role: remove files or registry keys during the boot phase, before Windows loads its full protections—useful for neutralizing persistent rootkits that resist hot removals.

The discovered technique: an attacker with administrator rights can send commands to BTR.sys to make it delete at next boot any file or registry key—including critical files of an EDR (Endpoint Detection and Response) or competing antivirus, normally locked by kernel-mode drivers.

Concrete result: the attacker can neutralize a third-party security solution without importing an external driver, without triggering a BYOVD (Bring Your Own Vulnerable Driver) alert, since BTR.sys is an officially Microsoft-signed driver already present on the machine.

Facts vs analysis

Facts:

• Impact: Windows 7 → Windows 11 25H2. The range is maximal.
• Prerequisites: administrator rights or existing kernel access. This is a post-exploitation technique, not an initial access vector.
• Microsoft has not confirmed a patch: BTR.sys does exactly what it was designed to do.

Analysis: The issue lies in the nature of the problem. A classic BYOVD imports a known vulnerable driver—modern EDR solutions have blocklists. Here, the driver is cleanly signed by Microsoft, integrated into Windows, and not on any blacklist. Detection techniques based on driver signatures are ineffective.

Who is impacted

Any Windows machine with Defender active—that is, the vast majority of Windows machines in professional and consumer environments. The most exposed environments: those relying on third-party EDR solutions (CrowdStrike, SentinelOne, etc.) without active monitoring of boot logs.