SecurityThe Hacker Newsabout 1 hour ago
Defender Driver Weaponized to Delete Security Software
1 min read
Check Point Research disclosed a technique using Microsoft Defender's legitimately signed BTR.sys boot-time driver to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2, with no flaw exploited. The attack deletes security software at boot without importing an external driver.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyMicrosoft
Summary by ByteBrief
