Endpoint Security22 August 2026
Defender's Own Boot Driver Can Be Turned Into an EDR-Killing Primitive
Check Point Research reverse-engineered BTR.sys, the signed Windows Defender remediation driver, and showed how it can delete or overwrite security software before other endpoint agents even start.
windows-securityedr-bypassliving-off-the-land