Windows Defender Driver Abuse Enables Kernel-Level EDR and Antivirus Bypass

Security researcher Jiří Vinopal has published a detailed analysis of BTR.sys, the Microsoft Defender Boot-Time Removal driver.