Signed Driver Abuse

Defender's own signed driver becomes the bypass: BTR.sys and the week's trusted-component defects

Check Point says Microsoft's signed BTR.sys remediation driver can be repurposed as a kernel operation engine with no vulnerable driver needed. Signature-based blocking does not apply.