Microsoft Defender’s Boot-Time Driver Can Be Abused to Delete Security Software
Check Point Research has disclosed a technique that abuses Microsoft Defender's own legitimately signed boot-time remediation driver, BTR.sys, to perform arbitrary kernel-level…