Check Point Research has revealed a technique that leverages Microsoft Defender’s own boot-time driver, BTR.sys, to execute kernel-level operations on Windows systems spanning from Windows 7 to Windows 11 25H2. This approach does not exploit any software flaws or import external drivers; instead, it utilizes a legitimate, signed component of Windows that cannot be blocked without affecting Defender itself. The driver is embedded in Defender’s MpEngine.dll and is usually activated to remove malware during system reboots. The findings, presented by Jiří Vinopal at Black Hat USA 2026 and DEF CON 34, included a proof-of-concept tool named BTR_CLI. This tool can install BTR.sys as a service, bypassing traditional controls, and perform operations such as deleting locked files and modifying registry entries before Defender’s user-mode services start. Although there is currently no evidence of this technique being used in real-world attacks, it represents a significant architectural loophole rather than a traditional vulnerability. Exploitation requires an administrator account with SeLoadDriverPrivilege, and no patch is planned because the issue relies on existing administrative privileges. Check Point Research advises restricting SeLoadDriverPrivilege to mitigate potential abuse.