Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Notícia de segurança recolhida automaticamente.

Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine.

The driver, BTR.sys (Boot Time Removal Tool), is a

Fonte original: Ler artigo completo aqui