BTR.sys: Microsoft Defender’s Boot-Time Removal Tool Driver
BTR.sys is a legitimate signed driver used by Microsoft Defender to remove malware after a reboot. It is embedded in MpEngine.dll and…
Tag: BTR.sys
Microsoft Defender’s Boot-Time Driver Can Be Abused to Delete Security Software
Check Point Research has disclosed a technique that abuses Microsoft Defender's own legitimately signed boot-time remediation driver, BTR.sys, to perform arbitrary kernel-level…
CVE-2021-24092: Privilege Escalation in Microsoft Defender’s BTR.sys
CVE-2021-24092 is a privilege escalation vulnerability in Microsoft Defender's BTR.sys driver, disclosed by SentinelLabs researcher Kasif Dekel in February 2021. It allowed…