Do Son 
At a Glance
| Research | BTR Reforged (Check Point Research) |
| Component | BTR.sys, the Windows Defender Boot-Time Removal driver |
| Technique | Repurposing a signed Microsoft driver into a kernel primitive |
| Impact | Arbitrary file and registry operations from Ring 0; EDR/AV bypass |
| Requirement | Pre-existing admin rights (SeLoadDriverPrivilege) |
| In-the-wild status | No real-world abuse observed at time of research |
| Source | Check Point Research write-up |
TL;DR
Check Point researchers reverse-engineered BTR.sys, a signed Windows Defender remediation driver. They showed that BTR.sys driver abuse can run file and registry operations from the kernel. The technique needs no exploit and works as a stealthy EDR/AV bypass.
What the Research Found
The story started with a false alarm. During an incident response case, odd telemetry traced back to legitimate Defender activity. That trail led to a driver on disk with a random name and RC4 encryption. The team dug in and mapped the driver fully.
BTR.sys ships inside MpEngine.dll. Defender drops it only when a cleanup task needs a reboot, such as deleting a locked file. It is a one-shot driver. It loads, runs a list of actions, reports status, then unloads itself.
The key discovery is how it takes orders. The driver reads an encrypted configuration from an Alternate Data Stream. As the report states, this “custom protocol, and an unexpectedly powerful kernel execution model” turned a defensive tool into an offensive one.
A Signed Kernel Primitive
Check Point built a proof-of-concept tool called BTR_CLI. It crafts valid encrypted transactions the driver accepts. The driver then performs six action types. These include deleting files, moving files, and writing registry values. Moving a file into System32 gives an arbitrary write primitive.
The researchers describe the result plainly. Their goal was to show “when defensive technology becomes offensive capability.” This is BTR.sys driver abuse in its clearest form.
How the EDR/AV Bypass Works
The bypass relies on timing, not a flaw. Windows loads drivers in phases during boot. BTR_CLI schedules the driver in the “Boot Bus Extender” group. That slot runs early in Phase 1, right after the filesystem comes online.
At that moment, the disk is writable. Yet Defender’s user-mode service has not started. Check Point calls this gap a “Golden Window.” In it, a signed kernel driver can delete or move protected security files. Boot logging confirmed the timeline on a fully updated Windows 11 25H2 machine.
Defender Dismantled From Ring 0
Tests deleted core Defender binaries during boot. The main antivirus service then failed to start at all. That blocks self-healing and cloud reporting. The tool also deleted Defender service registry keys at runtime. This move bypassed Tamper Protection, since the request came from a signed kernel driver.
Attribution and Scope
This is defensive research, not an active attack. Check Point found no sign of real-world abuse. The report notes the team “did not observe evidence of real-world abuse of BTR.sys.” So the threat is proven in a lab, not yet in the wild.
Microsoft’s response matters too. Following disclosure, MSRC said the findings do not meet the bar for immediate servicing. The reason is that the technique needs admin rights first. That decision leaves BTR.sys as a fully allowed Living-off-the-Land driver.
Why This Is Hard to Block
Signature blocking will not help here. BTR.sys is a genuine, signed Microsoft component. The Vulnerable Driver Blocklist does not cover a driver meant to exist. Unlike typical BYOVD attacks, no external driver is introduced.
Detection and Mitigation Guidance
Defenders should watch behavior, not just hashes. First, monitor for Alternate Data Streams named “:changelist” on .sys files. Sysmon Event ID 15 captures this with high fidelity. Second, flag the System process (PID 4) deleting security binaries right after a driver load.
Also restrict privileges tightly. The abuse depends on the attacker holding SeLoadDriverPrivilege. Enforce least privilege and audit that right. Finally, alert on driver loads whose parent process sits outside the Defender ecosystem, such as cmd.exe or PowerShell.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
