Check Point Research has disclosed a technique leveraging Microsoft Defender's legitimately signed boot-time remediation driver (BTR.sys) to perform arbitrary kernel-level file and registry operations on Windows systems. The technique affects Windows versions from Windows 7 through Windows 11 25H2. No software vulnerability is exploited and no external driver is required, making this a living-off-the-land attack using a trusted Microsoft-signed component. The driver, known as Boot Time Removal Tool (BTR.sys), can be weaponized to delete security software or other files at boot time. This represents a significant threat as it abuses a trusted, signed Microsoft component to bypass security controls.
Check Point Research disclosed a technique called 'BTR Reforged' that weaponizes Microsoft Defender's own legitimately signed boot-time remediation driver (BTR.sys) to perform arbitrary kernel-level file and registry operations. BTR.sys (Boot Time Removal Tool) is embedded in Defender's MpEngine.dll as the BOOTTIMETOOL resource and is deployed when Defender must finish removing malware after a reboot. The driver's proprietary transaction protocol is RC4-encrypted with a 256-byte key hard-coded in the .rdata section of every BTR.sys build since Windows 7, verified unchanged across 18 unique 64-bit versions. The proof-of-concept tool BTR_CLI extracts BTR.sys from MpEngine.dll under Defender's Definition Updates, constructs a valid encrypted transaction, and installs the driver as a service via direct HKLM registry writes using Type=1, Start=1, and Group='Boot Bus Extender', bypassing the Service Control Manager entirely and generating no Windows Event ID 7045 entry. When loaded, BTR.sys executes from Ring 0 (attributed to System process PID 4) and can delete locked files and directories, move files to unconstrained paths including System32\drivers, delete and write registry keys and values. It operates during a 'golden window' after the filesystem becomes writable but before Defender's user-mode services start, allowing deletion of security binaries such as WdFilter.sys and MsMpEng.exe before they lock themselves. Exploitation requires an administrator account with SeLoadDriverPrivilege. Unlike BYOVD attacks, this technique uses a driver built into every Windows installation from Windows 7 onward and cannot be added to Microsoft's Vulnerable Driver Blocklist or blocked via WDAC without disrupting Defender itself. MSRC confirmed these findings do not meet criteria for immediate servicing as the technique relies on pre-existing administrative privileges. A live demonstration at Black Hat USA 2026 showed BTR_CLI deleting the entire Defender stack from a fully updated Windows 11 25H2 machine with Tamper Protection active.
1. Restrict assignment of SeLoadDriverPrivilege as the primary hardening control, as this privilege is required for exploitation. 2. Monitor for Sysmon Event ID 15 (FileCreateStreamHash) where target filename ends in .sys:changelist. 3. Monitor for RegistryEvent (Sysmon Event ID 12 or 13) creating a service key whose Args value contains ':changelist' and whose Group is 'Boot Bus Extender', especially without a corresponding Windows Event ID 7045. 4. Monitor for Sysmon Event IDs 11 (FileCreate) and 23 (FileDelete) logging rapid creation and deletion of \SystemRoot\Temp\BootClean.log by the System process (PID 4). 5. Monitor for Sysmon Event ID 6 (DriverLoad) immediately followed by Sysmon Event ID 23 (FileDelete) attributed to the System process (PID 4). 6. Implement proactive detection engineering based on the provided Sysmon and Windows event conditions before the technique appears in the wild. 7. Note: No patch is currently planned by Microsoft; mitigation relies on privilege restriction and behavioral detection.
Sysmon Event ID 15 (FileCreateStreamHash) where target filename ends in .sys:changelist, RegistryEvent (Sysmon Event ID 12 or 13) creating a service key whose Args value contains ':changelist' and whose Group is 'Boot Bus Extender' without accompanying Windows Event ID 7045, Sysmon Event IDs 11 (FileCreate) and 23 (FileDelete) logging rapid creation and deletion of \SystemRoot\Temp\BootClean.log by System process (PID 4), Sysmon Event ID 6 (DriverLoad) immediately followed by Sysmon Event ID 23 (FileDelete) attributed to System process (PID 4), Registry service key with Group='Boot Bus Extender', Type=1, Start=1 created without Event ID 7045, Alternate Data Stream named :changelist written to a .sys file, BTR_CLI tool at github.com/Dump-GUY/BTR_CLI
