Microsoft Defender Built‑in Driver Abuse Enables Deletion of Security Software at Boot
Microsoft Defender built‑in driver abuse leverages the signed BTR.sys driver to erase security components during the boot process, exposing a critical trust bre