Microsoft Defender's Driver Can Be Weaponized to Delete Security Software
Windows' own security tool remains vulnerable to malicious exploitation.
1How Microsoft Defender's Driver is Weaponized
Check Point Research discovered that Microsoft Defender's legitimately signed BTR.sys driver can be used to perform arbitrary kernel-level file and registry operations on Windows systems from Windows 7 to Windows 11 25H2. This technique works without exploiting any software flaws or importing external drivers. Since BTR.sys is a required Windows component, it cannot be added to Microsoft's Vulnerable Driver Blocklist.
2Research Details and Presentation
Check Point Research threat researcher Jiří Vinopal presented the findings at Black Hat USA 2026 and DEF CON 34. The research was published on August 20, 2026, accompanied by a proof-of-concept tool called BTR_CLI. Researchers stated they found no evidence of this technique being used in real-world attacks, suggesting it remains unknown or unused by threat actors.
3BTR.sys Operation Mechanism
BTR.sys is embedded in Defender's MpEngine.dll file and is used to remove malware after a system reboot. Vinopal reverse-engineered the driver's undocumented transaction protocol, discovering that every configuration blob is RC4-encrypted with a key that has remained unchanged since Windows 7. This shows the driver functions identically across different Windows versions.
4BTR_CLI Tool Functionality
BTR_CLI locates MpEngine.dll under Defender's definition updates and extracts the embedded BTR.sys binary. The tool constructs a valid encrypted transaction and installs the driver as a service via direct registry writes, completely bypassing the Service Control Manager and generating no Windows event logs. When loaded, the driver executes as the System process (PID 4) and can delete locked files.
5Driver Loading and Execution Process
BTR.sys operates during what Vinopal calls the 'golden window' - after the filesystem becomes writable but before Defender's user-mode services start. This allows the driver to physically remove security binaries like WdFilter.sys and MsMpEng.exe. A live demonstration at Black Hat showed BTR_CLI deleting Defender's entire stack from a fully updated Windows 11 25H2 machine with Tamper Protection active.
6Attack Prerequisites
Exploiting this technique requires an administrator account with SeLoadDriverPrivilege. BTR_CLI automatically enables this privilege for accounts that already have it. Unlike traditional 'bring your own vulnerable driver' attacks, this method uses a driver built into every Windows installation since Windows 7.
7Microsoft's Stance and Historical Context
Microsoft stated these findings don't represent a traditional vulnerability but rather a trust boundary crossing that requires existing admin privileges. MSRC confirmed the technique doesn't meet immediate servicing criteria. While Vinopal's GitHub repository notes 'no patch is planned,' Microsoft hasn't officially commented. BTR.sys was previously examined for a different flaw five years earlier.
8Security Recommendations and Implications
Check Point Research identified Sysmon and Windows event conditions as potential indicators of BTR.sys abuse. They recommend restricting SeLoadDriverPrivilege assignment as the primary hardening control. BTR_CLI is available on GitHub under MIT license. This research provides a significant example of how security software components can be weaponized against themselves.