Security is only as strong as its weakest link — and this week, that link turned out to be Microsoft's own antivirus driver. Check Point Research has disclosed a technique that weaponises BTR.sys, Microsoft Defender's legitimately signed boot-time remediation driver, to perform arbitrary kernel-level file and registry deletions on any Windows machine from Windows 7 through Windows 11 25H2. No vulnerability is exploited. No foreign driver is imported. The attack uses Microsoft's own hardware — the security software itself — to tear out whatever it likes.

The mechanism is deceptively elegant. BTR.sys ships with Windows as a trusted, signed component whose entire job is to remove stubborn malware at boot time before the OS fully loads. Attackers who already have initial access can instruct it to target legitimate security tools instead: endpoint detection agents, logging infrastructure, kernel-level defences. Because the driver is signed and expected by Windows, security controls designed to block malicious drivers simply wave it through. It's the equivalent of using a building's own security guard to lock out the rest of the security team.

What makes this especially uncomfortable is the "no bug exploited" framing. There's no CVE to patch, no specific flaw to remediate. The driver is behaving exactly as designed. The issue is that its design — trusted, powerful, boot-time — makes it an attractive tool for post-compromise cleanup. Defenders can't simply pull the driver without breaking Defender itself.

The practical threat model requires an attacker to already be on the machine with sufficient privilege to invoke the driver, so this isn't a remote-access scenario out of the box. But in the context of ransomware operations — where attackers routinely spend days inside a network before triggering their payload — the ability to silently disable endpoint defences at boot is extremely valuable. Several notable ransomware families already use "bring your own vulnerable driver" (BYOVD) techniques for exactly this purpose. BTR.sys removes the "vulnerable" requirement entirely: it's already there, already trusted, already powerful.

Microsoft has not yet issued a patch, and it's unclear whether one is forthcoming given no software flaw underpins the technique. Check Point recommends monitoring for unusual BTR.sys invocations and restricting which processes can interact with boot-time drivers. In environments running third-party EDR tools, defenders should verify whether those tools have any self-protection mechanisms that can survive a boot-time deletion attempt.

For Australian organisations, this sits squarely in the territory covered by the Australian Cyber Security Centre's Essential Eight — specifically Application Control and Restricting Administrative Privileges. Any Windows environment relying on Defender as a primary endpoint control should be reviewing driver invocation telemetry now. If your security tooling can be silently deleted before Windows even finishes loading, your incident response plan needs a new first chapter.