Microsoft's Own Antivirus Driver Can Be Turned Into a Weapon at Boot

Key points

• Check Point Research disclosed a technique that abuses BTR.sys, a legitimately signed Microsoft Defender driver, to run kernel-level file and registry deletions during Windows boot.
• The technique works on every supported version of Windows, from Windows 7 through Windows 11 25H2, with no software flaw involved.
• Attackers need no external driver: the tool ships with Defender itself.
• The technique could be used to disable rival security products before they load, a step common in ransomware attacks.
• Microsoft has not classed it as a vulnerability because the driver is working exactly as designed.

A new piece of research from Check Point, first reported by The Hacker News, shows something awkward for Microsoft. One of the trusted tools inside Microsoft Defender, the antivirus built into Windows, can be pointed at almost anything on a PC and told to delete it before the operating system finishes starting up.

The tool is called BTR.sys, short for Boot Time Removal Tool. It is a driver, meaning a small piece of software that talks directly to the guts of Windows. Defender uses it to clean up infections that hide themselves while Windows is running. To do that job, it needs elevated powers at the earliest stage of boot.

That is exactly the power Check Point figured out how to borrow.

What did the researchers actually do?

They used Defender's own cleanup driver against the machine it was meant to protect. By feeding BTR.sys a crafted instruction file, the researchers made it delete arbitrary files and registry entries during boot, the moment when almost no other security software is awake to stop it.

Nothing was hacked in the traditional sense. There was no software bug, no zero-day, meaning no secret flaw the vendor didn't know about. The driver is signed by Microsoft, behaving exactly as it was written to behave. It just happens to accept instructions that a clever attacker can supply.

Security people call this a living-off-the-land attack: the hackers do not bring their own tools, they use the ones already on the machine. It's the desktop equivalent of a burglar using the homeowner's own keys.

Why does using a Microsoft driver matter?

Because Windows has spent years trying to stop attackers from loading dodgy drivers at boot. Modern Windows keeps a blocklist of known-bad ones. BTR.sys sails past all of that, because it is a Microsoft driver.

That also means the usual defence, blocking vulnerable third-party drivers, does not help here. You cannot easily block a component of the built-in antivirus without breaking the antivirus.

We've been tracking this corner of the threat landscape closely. Our July story on the 'GodDamn' ransomware gang showed a criminal crew already using a Microsoft-stamped driver to kill antivirus tools before locking files. BTR.sys hands future attackers a cleaner, pre-installed version of that same playbook.

Which versions of Windows are affected?

All of them that anyone still runs. Check Point tested the technique against Windows versions going back to Windows 7 and forward to Windows 11 25H2, the most recent release.

Should ordinary users be worried?

Not in a panic sense. To pull this off, an attacker already needs administrator access to your PC. If someone has that, they can do plenty of damage without any of this cleverness.

The real concern is corporate. Ransomware crews love any trick that lets them switch off security software before they strike. A signed Microsoft driver that quietly deletes files at boot is close to the perfect tool for that job. Expect it to appear in real attacks.

Microsoft has not treated the finding as a vulnerability. The driver is doing what it was built to do. That leaves defenders watching for misuse of a tool they cannot simply remove.

For home users, the practical advice is dull but real: don't run as administrator day to day, keep Defender on, and be wary of installers that ask for elevated permissions they shouldn't need.