Driver Blocklisting and WDAC Policy

Defender's own boot driver is a kernel delete primitive, and Microsoft is not servicing it

Check Point's BTR Reforged turns a required Defender component into Ring 0 file and registry deletion on Windows 7 through 11 25H2. It cannot be blocklisted, so detection is the only lever left.