Living Off The Land

Defender's Own Boot Driver Can Be Turned Into an EDR-Killing Primitive

Check Point Research reverse-engineered BTR.sys, the signed Windows Defender remediation driver, and showed how it can delete or overwrite security software before other endpoint agents even start.