CVE-2021-24092 is a privilege escalation vulnerability in Microsoft Defender's BTR.sys driver, disclosed by SentinelLabs researcher Kasif Dekel in February 2021. It allowed a local non-administrator to overwrite arbitrary files by placing a hard link at the driver's log path. Microsoft patched the vulnerability on February 9, 2021.