tech π‘οΈ Microsoft's own driver can delete security software
Check Point Research discovered a method leveraging Microsoft Defender's BTR.sys driver for kernel-level file and registry manipulation. This technique works on Windows 7 through Windows 11 25H2 without exploiting traditional software flaws or using external drivers. The researchers presented this at Black Hat USA 2026 and DEF CON 34 on August 20, 2026. It allows the driver to delete security binaries during a reboot, even with Tamper Protection active. Microsoft confirmed this doesn't require immediate patching since it needs existing admin privileges. π οΈ