Vulnerability Research
Microsoft Defender's Signed BTR.sys Driver Can Be Weaponized in the Kernel, Check Point Finds
Check Point Research disclosed that BTR.sys, Microsoft Defender's own legitimately signed remediation driver, can be turned into a kernel operation primitive for arbitrary file and registry changes across Windows 7 through Windows 11 25H2, with no external driver imported.