From Check Point Research: Check Point Research has investigated the #WindowsDefender Boot-Time Removal driver, BTR.sys, showing that the Microsoft-signed remediation component can be repurposed to perform privileged file and registry changes during startup. Researchers developed BTR_CLI to craft encrypted tasks and found that multiple versions share a hard-coded RC4 key. https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/ #CheckPoint #CheckPointSoftwareTechnologies