Your Own Antivirus Just Became an Attacker's Toolkit

Last week we wrote about the friendly voice on the phone convincing an accountant to wire $25 million to the wrong bank. This week the threat is quieter, uglier, and closer to home: the security software sitting on every Windows machine in your office.

On August 21, Check Point Research disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver — BTR.sys, the Boot Time Removal Tool — to perform arbitrary kernel-level file and registry operations on Windows systems from Windows 7 through Windows 11 25H2. No software flaw was exploited. No malicious driver was loaded. The driver shipped with Defender, signed by Microsoft, and trusted by Windows. Researchers showed it can delete security software, tamper with the registry, and rewrite files before any userland protection has a chance to start.

If you run a small or midsize business and you trust that green shield icon in the system tray, this should change what "hardened" means to you in 2026.

The driver that was never supposed to do this

BTR.sys is meant to clean up files Windows can't touch while the system is running: locked files, in-use DLLs, the things that have to die before the operating system finishes booting. Microsoft uses it during feature updates and malware remediation. It runs early, it runs with kernel privileges, and Windows trusts it because Microsoft signed it.

Check Point's finding is not that BTR.sys is buggy. The driver works exactly the way Microsoft designed it. The problem is the design. A boot-time driver with full kernel file-and-registry write access, signed by a trusted vendor, is a powerful thing on its own. When an attacker can invoke that capability on demand — by abusing the same legitimate Microsoft-signed binary — the signing model breaks.

The technique was demonstrated end-to-end on Windows 11 25H2 with Defender active. The researchers were able to use the Microsoft-signed driver to delete arbitrary files, modify registry entries, and disable other security products. None of those actions required disabling Defender first. Defender was running the whole time. It just could not see what its own driver was doing.

This is not a vulnerability Microsoft can patch next Tuesday with a CVE. It is a design pattern: "we ship a powerful kernel component, signed by us, that does X" combined with an attacker who has enough local access to invoke it.

Why the trust model is the actual problem

Antivirus software has lived inside a comfortable assumption for two decades: the AV vendor is on your side, so anything they sign is also on your side. That assumption was reasonable in 2005. It is dangerous in 2026.

The Defender BTR technique is one of three high-profile "your security tool is the weapon" stories in the last two weeks. On August 19, CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including an improper authentication flaw in Apple macOS (CVE-2026-65400, CVSS 9.8) that lets attackers bypass login entirely. Two days later, Microsoft patched a CVSS 10.0 remote code execution flaw in Entra ID — the identity control plane that gates access to Office 365, Azure, and half the SaaS stack small businesses rely on.

Three stories. Same shape. The tools you bought to protect yourself are now where the attackers live.

This is the harder version of supply-chain risk. A trojanized npm package or a malicious Chrome extension is somebody else's code that got into your environment. A signed kernel driver from your own security vendor is somebody else's code that your operating system was built to trust. Defending against the second one is a different problem.

What actually moves the needle

A small IT team cannot audit Microsoft's driver-signing pipeline. What it can do is make the attacker's job harder at every other layer, so the BTR-class technique never gets the opening it needs.

Require Secure Boot and a measured-boot posture. BTR runs at boot, before most defenses load. Secure Boot plus a TPM-measured boot chain stops unsigned or tampered boot-time components from loading. BitLocker with a TPM PIN or startup key on every laptop and desktop, not just executives. Microsoft has published the configuration; an afternoon with the right GPO template is enough for most fleets.

Treat Defender as a layer, not the perimeter. If your security story begins and ends with "we have Defender on it," the next story about a Defender technique bypass is your story too. Pair Defender with a host-based firewall rule set that blocks outbound traffic from system processes to non-Microsoft domains, and an allowlist for unsigned executables in your EDR console. The point is to make a Defender-bypass attack fail at the next layer down, not the next one up.

Audit the signed-driver allowlist. Windows by default trusts any driver signed by a vendor in the Microsoft certificate chain. There are tools — WDAC, Microsoft Defender Application Control — that lock that list down to exactly the vendors your business uses. Maintaining that allowlist is annoying. It is also the single most effective hardening move against this whole class of attack, and it costs nothing to deploy.

Watch the boot surface in your EDR. Most EDR products log boot-time driver loads but do not alert on them by default. Flip that switch. If a BTR-class component loads on a machine that should not be in remediation, that is the alert that catches the technique in the act.

Treat macOS and Entra ID like the rest of your fleet. The CISA KEV additions this month are not theoretical. SMBs that use M-series Macs for creative work, or that have outsourced identity to Microsoft 365, are exposed in both directions. Make sure your Mac fleet is on a recent enough build to have the patched macOS auth handling, and that you are running Microsoft Entra's Conditional Access policies rather than relying on the legacy per-app MFA configuration.

The honest closing

The Defender BTR disclosure is going to age into a long footnote. Microsoft will not remove BTR.sys — it is doing legitimate work — and the technique will not get a CVE because nothing is broken. What small businesses should take from it is more uncomfortable: the security tools you bought in 2020 were designed for an attacker who is not showing up in 2026.

The defender's job is no longer "stay current on patches and run antivirus." It is "constantly re-evaluate which parts of your stack you are trusting by default, because the attackers are now aiming at the trust itself." That is harder, more annoying, and less satisfying than installing a green shield icon. It is also the only thing that works.