Microsoft's own remediation driver weaponized into a Ring-0 file/registry primitive
Check Point reverse-engineered BTR.sys, the signed Windows Defender boot-time remediation driver, and proved its proprietary encrypted transaction format can be abused to carry out arbitrary file and registry operations from Ring 0 — with no exploits, no memory corruption, no traditional BYOVD. Their new open BTR_CLI tool even uses it to disarm EDR/AV, hiding malicious kernel operations inside trusted Microsoft-signed code. The research surfaced from an incident where the driver appeared under a randomized name and service — and it raises the question of how many more signed remediation components hide the same primitive.