Pulse of Truth

2497 readers

28 users here now

Cyber Security news and links to cyber security stories that could make you go hmmm. The content is exactly as it is consumed through RSS feeds and wont be edited (except for the occasional encoding errors).

This community is automagically fed by an instance of Dittybopper.

Commenting rules:

Be respectful.
No bigotry (including racism, sexism, homophobia, transphobia).
No pornography.
Nothing illegal.
More rules will be added when necessary

founded 2 years ago

MODERATORS

krogoth@infosec.pub

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot (thehackernews.com)

submitted 1 hour ago by lemmydev2@infosec.pub to c/pulse_of_truth@infosec.pub

0 comments fedilink hide all child comments

Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine.

The driver, BTR.sys (Boot Time Removal Tool), is a

no comments (yet)

sorted by: hot top controversial new old

there doesn't seem to be anything here