THREAT OPS › Threat News › BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive
<p class="wp-block-paragraph"><strong>Research by: Jiří Vinopal</strong> <strong>(</strong><a href="https://x.com/vinopaljiri" id="https://x.com/vinopaljiri" rel="noreferrer noopener" target="_blank" type="link">@vinopaljiri</a><strong>)</strong></p>
<h2 class="wp-block-heading">Abstract</h2>
<p class="wp-block-paragraph">What if a <strong>trusted security component</strong> could be repurpo
MITRE ATT&CK techniques
Indicators of compromise
- https://www.virustotal.com/gui/search/signature%253A%2522Boot%2520Time%2520Removal%2520Tool%2522%2520tag%253Asigned%2520tag%253A64bitsurl
- https://winbindex.m417z.com/?file=mpengine.dllurl
- https://loldrivers.io/url
- s.w.orgdomain