Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Researchers at Check Point have found a way to utilize a legitimate Microsoft Defender driver to carry out unauthorized actions on Windows systems. This technique affects Windows versions from 7 to 11, specifically 25H2, and does not rely on exploiting any software vulnerabilities or importing external drivers. The driver in question, known as the Boot Time Removal Tool, is a legitimate component of Microsoft Defender. It can be used to perform arbitrary kernel-level operations, including file and registry modifications, at boot time. This could potentially be used to delete security software. The driver's legitimacy and native presence on the system make it a significant concern.