Microsoft's Own Antivirus Driver Can Be Turned Into a Weapon at Boot

Key points

• Check Point Research disclosed a technique that abuses BTR.sys, a legitimately signed Microsoft Defender driver, to run kernel-level file and registry deletions during Windows boot.
• The trick works on every supported version of Windows, from Windows 7 through Windows 11 25H2, with no software flaw involved.
• Attackers do not need to smuggle in a shady driver: the tool ships with Defender itself.
• The technique could be used to disable rival security products before they load, a step often seen in ransomware attacks.
• Microsoft has not classed it as a vulnerability because the driver is working exactly as designed.

A new piece of research from Check Point, first reported by The Hacker News, shows something awkward for Microsoft. One of the trusted tools inside Microsoft Defender, the antivirus built into Windows, can be pointed at almost anything on a PC and told to delete it before the operating system finishes starting up.

The tool is called BTR.sys, short for Boot Time Removal Tool. It is a driver, meaning a small piece of software that talks directly to the guts of Windows. Defender uses it to clean up nasty infections that hide themselves while Windows is running. To do that job, it needs god-mode powers at the earliest stage of boot.

That is exactly the power Check Point figured out how to borrow.

What did the researchers actually do?

They used Defender's own cleanup driver against the machine it was meant to protect. By feeding BTR.sys a crafted instruction file, the researchers made it delete arbitrary files and registry entries during boot, the moment when almost no other security software is awake to stop it.

Nothing was hacked in the traditional sense. There was no software bug, no zero-day, meaning no secret flaw the vendor didn't know about. The driver is signed by Microsoft, trusted by Windows, and behaving exactly as it was written to behave. It just happens to accept instructions that a clever attacker can supply.

If that sounds familiar, it should. Security people call this a living-off-the-land attack: the hackers do not bring their own tools, they use the ones already on the machine. It is the desktop equivalent of a burglar using the homeowner's own keys.

Why does using a Microsoft driver matter?

Because Windows has spent years trying to stop attackers from loading dodgy drivers at boot. Modern Windows keeps a blocklist of known-bad ones. BTR.sys sails past all of that, because it is a Microsoft driver.

That also means the usual defence, blocking vulnerable third-party drivers, does not help here. You cannot easily block a component of the built-in antivirus without breaking the antivirus.

Which versions of Windows are affected?

All of them that anyone still runs. Check Point tested the technique against Windows versions going back to Windows 7 and forward to Windows 11 25H2, the most recent release.

Should ordinary users be worried?

Not in a panic sense. To pull this off, an attacker already needs administrator access to your PC. If someone has that, they can do plenty of damage without any of this cleverness.

The real worry is corporate. Ransomware crews, the criminals who lock up company files and demand payment, love any trick that lets them switch off security software before they strike. A signed Microsoft driver that quietly deletes files at boot is close to the perfect tool for that job. Expect it to show up in real attacks.

Microsoft, for its part, has not treated the finding as a vulnerability. The driver is doing what it was built to do. That leaves defenders in the odd position of watching for misuse of a tool they cannot simply remove.

For home users, the practical advice is dull but real: do not run as administrator day to day, keep Defender turned on, and be wary of installers that ask for elevated permissions they should not need.