Microsoft Defender Driver Flaw Lets Attackers Strip PCs of Protection at Boot
Security researchers have shown that attackers can abuse a signed Microsoft Defender driver to delete antivirus and security tools at boot, even on fully updated Windows 11 systems with Tamper Protection enabled. The finding turns one of Microsoft’s core defenses into an attack tool, raising the risk for governments, companies, and critical infrastructure operators that rely on Defender as a primary shield.
A newly disclosed technique is turning one of Microsoft’s flagship security tools into a liability. Researchers have demonstrated that attackers can weaponize a signed Microsoft Defender driver, BTR.sys, to delete antivirus and endpoint protection software during boot—stripping Windows machines of their defenses before they even start up fully.
The method, detailed by Check Point, shows that BTR.sys can run in Ring 0 with kernel‑level privileges early in the boot process, before Defender’s user‑mode services initialize. By exploiting how the driver handles operations, attackers can manipulate it to remove key security components, effectively disarming Microsoft Defender and other protections on systems running Windows 11 25H2, even when Tamper Protection is turned on.
For everyday users, the risk is largely invisible but significant. A PC that appears to be protected—showing Defender enabled and up to date—could in reality have had its core defenses gutted at startup by malware with the right exploit chain. Corporate laptops, home desktops, and shared systems in schools or hospitals all become potential soft targets if an attacker can gain sufficient initial access to deploy the malicious use of the driver.
Operationally, the flaw is a powerful tool for advanced attackers because it undermines one of defenders’ last lines: endpoint security that can detect and block malicious activity even after a breach. By neutralizing antivirus and monitoring agents before they load, intruders can move laterally, exfiltrate data, or deploy ransomware with less risk of detection. For incident responders, compromised logs and missing agents can make reconstructing what happened slower and less reliable.
The strategic concern is sharper for governments, critical infrastructure operators, and large enterprises that have standardized on Defender as a primary or backup security layer. The ability to turn a trusted, signed Microsoft driver into a weapon tilts the balance in favor of threat actors who already invest heavily in persistence and evasion. Nation‑state groups in particular prize signed‑driver abuse because it blends seamlessly into normal system activity and can survive reboots.
This technique also fits into a broader pattern of attackers exploiting trusted components rather than obvious malware. From abusing signed drivers to hijacking legitimate remote‑management tools, adversaries are increasingly using security products themselves as cover or leverage. The line between “defense” and “attack surface” is getting thinner, especially when complex tools run with the highest system privileges.
One sentence captures the new reality: when attackers can turn your antivirus into their uninstall tool, trust in the security stack becomes as important as any single patch. Organizations now have to ask not just whether Defender is updated, but whether any of its deepest components can be misused against them.
What matters next is how quickly Microsoft moves to mitigate the issue—whether through driver revocation, updates that harden BTR.sys, or architectural changes that limit what kernel‑level components can delete at boot. Security teams should watch for guidance from Microsoft, signatures and detections from security vendors that can spot abuse of the driver, and any evidence that the technique is migrating from research labs into real‑world campaigns, particularly against high‑value targets.
Sources
- OSINT