Tag: BTR.sys

Defender boot driver opens kernel file writes on all Windows versions

Check Point weaponizes Microsoft's signed BTR.sys driver to run kernel-level operations with no flaw exploited.