Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Security researchers have found a way to weaponize Microsoft Defender's own driver to disable security software. The driver can be used to delete endpoint detection and response (EDR) and antivirus (AV) software at the Windows kernel level. This means that cybercriminals could potentially exploit this vulnerability to bypass security measures and gain unauthorized access to systems. The vulnerability lies in the Microsoft Defender's remediation driver, which can be manipulated to perform kernel-level operations.

According to Check Point Research, this driver can be weaponized to delete security software during the boot process. The Hacker News and CyberSecurityNews also confirm that this driver can be used to disable EDR and AV software, making systems more susceptible to attacks. The implications of this discovery are significant. Security software vendors and IT administrators will need to address this vulnerability to prevent potential exploits.

Microsoft has not yet released a patch or official statement regarding this issue. Researchers and cybersecurity experts are closely monitoring the situation, and updates are expected as more information becomes available.