Check Point Research has uncovered a technique that can use Microsoft Defender’s signed boot-time driver to perform kernel-level actions on Windows systems without exploiting a software vulnerability or installing an outside driver.
The driver (BTR.sys) is part of Microsoft Defender and has been included in Windows versions from Windows 7 through Windows 11 25H2. It’s designed to remove malware that can’t be deleted while Windows is running.
Researchers found that BTR.sys can also be used to delete locked files, modify registry entries and move files to sensitive locations. Check Point created a proof-of-concept tool called BTR_CLI that can be used as an EDR/AV bypass technique, disabling security solutions using a trusted Windows driver, without relying on typical BYOVD techniques.
The technique can also run during a short period after a reboot, before Defender’s main services start. Researchers said that this window could be used to remove important Defender components, including WdFilter.sys and MsMpEng.exe, even with Tamper Protection enabled.
The attack requires administrator access and the SeLoadDriverPrivilege. Unlike “bring your own vulnerable driver” attacks, the technique does not depend on a third-party driver that Microsoft can simply add to a blocklist.
Researchers said they disclosed their findings to Microsoft but the Windows maker said that the issue doesn’t “meet the criteria for immediate servicing, as the technique relies on pre-existing administrative privileges (SeLoadDriverPrivilege).” This classification establishes BTR.sys as a potent “Living-off-the-Land” driver (LOLDriver), Check Point said.
At present, there’s no evidence that attackers are using the technique in real-world attacks. The research was presented at Black Hat USA 2026 and DEF CON 34, with the research paper and BTR_CLI proof of concept published on August 20.