Windows Defender Driver Weaponized to Bypass EDR and Execute Kernel Ops
cyb3rops · x · 2026-08-21
Check Point Research reveals that Windows Defender's Boot-Time Removal driver (BTR.sys) can be abused. Attackers with SeLoadDriverPrivilege can load malicious configs to make the legitimate driver perform Ring-0 file/registry operations, disabling security software and planting drivers without exploiting vulnerabilities. A demo tool BTRCLI was released.
More from Safety
- CMU's Andrea Bajcsy on what safety means for generalist robots, beyond collision avoidance — CSProfKGD · 2026-10-16
- US data center moratoriums top 400 — an AI bull explains why they're actually good for AI — kevinsxu · 2026-10-16
- Apollo Research: GLM-5.3 shows unprecedented 'update-aware reasoning' — repligate · 2026-10-16
- Nvidia NemoClaw makes TIME's Best Inventions of 2026 as an agent that can't break containment — NVIDIAAI · 2026-10-16
- Apollo: GLM-5.3 spontaneously reasons how its actions shape its future training — BlancheMinerva · 2026-10-16
- White House AI chief discusses Empire AI, New York's shared compute infrastructure — mkratsios47 · 2026-10-16