Veille cybersecurite : Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot
Source : The Hacker News
Check Point Research has disclosed a technique that uses Microsoft Defender’s own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine.
The driver, BTR.sys (Boot Time Removal Tool), is a
Vous vous demandez si votre entreprise est exposee a ce type de faille ? Reservez un appel decouverte gratuit.