Security News Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot TheHackerNews Daniel Bender 21 Aug 2026 Share BTR Reforged uses Defender's signed BTR.sys with an administrator account and SeLoadDriverPrivilege for kernel file and registry operations.
