Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
BTR Reforged uses Defender's signed BTR.sys with an administrator account and SeLoadDriverPrivilege for kernel file and registry operations.
More info