Microsoft Defender's Signed BTR.sys Driver Can Be Abused for Kernel-Level Operations on Windows

Cybersecurity researchers have disclosed a technique that abuses Microsoft Defender's legitimate, digitally signed boot-time remediation driver, BTR.sys, to perform arbitrary file and registry operations at the Windows kernel level.

The technique, dubbed BTR Reforged by Check Point Research, does not rely on a traditional software vulnerability or require an attacker to introduce a third-party driver onto the system. Instead, it repurposes a legitimate Windows component that is already present as part of Microsoft Defender.

Check Point Research presented the research at Black Hat USA 2026 and DEF CON 34 in Las Vegas and published its technical analysis and proof-of-concept tool on August 20, 2026.

The researchers said they found no evidence that the technique has been used in real-world attacks.

"We did not observe evidence of real-world abuse of BTR.sys in the manner demonstrated in this research."

The finding is nevertheless significant because it demonstrates how a trusted Windows security component can potentially become a kernel-level offensive primitive after an attacker has already obtained administrator-level privileges.

What Is BTR.sys?

BTR.sys stands for Boot Time Removal Tool.

It is part of Microsoft Defender and is designed to help remove malware that cannot be deleted while Windows is running because files or registry entries are locked.

The driver is embedded inside Microsoft's Defender engine, specifically as the BOOTTIMETOOL resource within MpEngine.dll.

When Defender needs to perform remediation during boot, Windows can deploy the driver and allow it to perform operations before normal Defender user-mode services become fully active.

Check Point Research reverse-engineered the driver's undocumented transaction protocol and discovered that it could be used to instruct BTR.sys to perform a broader range of kernel-level operations.

No Traditional Vulnerability Is Required

Unlike conventional attacks involving vulnerable drivers, the BTR Reforged technique does not depend on exploiting a bug in BTR.sys.

It also differs from Bring Your Own Vulnerable Driver (BYOVD) attacks.

In a typical BYOVD attack, an adversary brings a legitimately signed but vulnerable third-party driver onto the machine and uses its vulnerabilities to obtain kernel-level capabilities.

Security products can potentially block those drivers through Microsoft's Vulnerable Driver Blocklist or application-control policies.

BTR.sys creates a different problem because it is a legitimate Microsoft component required by Defender.

Blocking the driver outright could interfere with Defender's own remediation functionality.

Check Point Research therefore described the issue as an architectural trust-boundary problem rather than a conventional vulnerability.

BTR.sys Exists Across Many Windows Versions

The research found the technique applicable to Windows versions ranging from:

• Windows 7
• Windows 8
• Windows 10
• Windows 11
• Windows 11 25H2

The researchers examined 18 different 64-bit BTR.sys builds and found that the RC4 encryption key used by the driver's transaction mechanism remained unchanged.

The key is hard-coded inside the driver's .rdata section.

How BTR Reforged Works

Check Point Research developed a proof-of-concept utility called BTR_CLI to demonstrate the technique.

The tool locates Microsoft's MpEngine.dll inside the Defender Definition Updates directory and extracts the embedded BTR.sys driver.

It can then construct a valid encrypted transaction that BTR.sys accepts.

The researchers discovered that BTR.sys uses an undocumented configuration format whose data is encrypted using RC4.

Once the transaction is prepared, the technique can register and load the driver using direct registry manipulation rather than relying on the normal Windows Service Control Manager workflow.

The demonstrated service configuration uses values including:

• Type=1
• Start=1
• Group="Boot Bus Extender"

Because the service registration is performed through direct registry writes, the activity can avoid generating the normal Windows Event ID 7045 associated with a service installation.

Kernel-Level File and Registry Operations

Once loaded, BTR.sys executes its queued operations from Ring 0.

The operations demonstrated by the researchers include:

• Deleting files
• Deleting directories
• Removing locked files
• Moving files
• Moving files into sensitive system locations
• Deleting registry keys
• Deleting registry values
• Creating or modifying registry values
• Writing registry values of different types

The activity is attributed by telemetry to the Windows System process, PID 4, because the operations are ultimately performed from kernel mode.

A second execution mode can also schedule operations for the next system reboot.

The "Golden Window"

One of the most important findings involves what Check Point Research calls the "golden window."

This is the period during system startup when the filesystem has become writable but Microsoft Defender's normal user-mode components have not yet fully started.

During this window, the BTR.sys driver can execute queued operations before Defender's protection components have an opportunity to initialize and protect themselves.

In a live demonstration, researchers used BTR_CLI against a fully updated Windows 11 25H2 system with Tamper Protection enabled.

The demonstration showed that the technique could remove components belonging to the Microsoft Defender security stack.

The researchers specifically demonstrated removal of security components including:

• WdFilter.sys
• MsMpEng.exe

This effectively demonstrates how a trusted boot-time remediation mechanism could potentially be repurposed to interfere with endpoint security.

Administrator Privileges Are Still Required

BTR Reforged is not a privilege-escalation technique.

An attacker must already have administrator-level access and the required SeLoadDriverPrivilege privilege.

BTR_CLI can automatically enable the privilege for an account that already possesses it.

This limitation is central to Microsoft's assessment.

Check Point Research said Microsoft Security Response Center (MSRC) determined that the findings did not meet the criteria for immediate servicing because exploitation requires pre-existing administrative privileges.

In other words, an attacker would generally need to compromise the system first before using BTR Reforged as a post-compromise security-bypass mechanism.

Why Microsoft Cannot Simply Block BTR.sys

The technique creates a difficult defensive problem because BTR.sys is not an unknown malicious driver.

It is:

• Microsoft-signed
• Part of Windows Defender
• Embedded inside Defender's engine
• Used for legitimate malware remediation
• Present across supported Windows environments

Consequently, treating it like an ordinary malicious or vulnerable third-party driver could interfere with Defender functionality.

This makes the technique fundamentally different from conventional BYOVD attacks.

Previous BTR.sys Vulnerability

This is not the first security issue discovered in BTR.sys.

In February 2021, SentinelLabs researcher Kasif Dekel disclosed CVE-2021-24092, a local privilege-escalation vulnerability involving the Defender boot-time remediation driver.

The vulnerability allowed a local non-administrator to overwrite arbitrary files through a hard-link attack involving the driver's logging mechanism.

Microsoft patched the vulnerability on February 9, 2021.

The new BTR Reforged research is different because it does not depend on that vulnerability or another software flaw.

Instead, it focuses on the driver's legitimate functionality and its trust relationship with Windows.

Detection Opportunities

Check Point Research identified several telemetry patterns that defenders can monitor for potential BTR.sys abuse.

Sysmon Event ID 15

Security teams can look for FileCreateStreamHash events where the target filename ends with:

.sys:changelist

The researchers said this can capture the encrypted configuration written to the driver's Alternate Data Stream.

Registry Events

Sysmon Event ID 12 or 13 can be monitored for service-key creation where:

• The Args value contains :changelist
• The service group is Boot Bus Extender
• No corresponding Windows Event ID 7045 appears

That combination may indicate unusual BTR.sys activity.

BootClean.log Activity

Researchers also identified rapid creation and deletion of:

\\SystemRoot\\Temp\\BootClean.log

The activity is attributed to the System process, PID 4.

Driver Load Followed by File Deletion

Another useful detection pattern is:

Sysmon Event ID 6 → Sysmon Event ID 23

where the driver load is followed immediately by file deletion activity attributed to PID 4.

Check Point Research described this sequence as a potential kernel-level BTR.sys execution fingerprint.

Restricting SeLoadDriverPrivilege

The researchers recommend restricting assignment of SeLoadDriverPrivilege as the primary hardening measure.

Organizations should review which accounts and services possess this privilege and remove it wherever it is not genuinely required.

Because BTR Reforged requires administrator-level access and this privilege, reducing unnecessary privilege assignments can significantly limit the attack surface.

No Evidence of Active Exploitation

Check Point Research emphasized that it has not identified evidence that threat actors are currently abusing BTR.sys using the demonstrated technique.

The researchers said this provides defenders with an opportunity to build detections before the technique becomes operationalized by attackers.

The research originated during an incident-response investigation in which suspicious endpoint telemetry was initially observed.

The activity was ultimately traced back to legitimate Microsoft Defender remediation behavior, prompting researchers to investigate how the Defender component worked internally.

BTR_CLI Proof of Concept

Check Point Research also released BTR_CLI, a proof-of-concept implementation demonstrating the technique.

The tool is available publicly under the MIT license, with prebuilt x64 and x86 binaries provided through the project's releases.

The publication gives defenders an opportunity to reproduce the behavior in controlled environments and develop detections around BTR.sys activity.

A New Direction for BYOVD-Style Attacks

The research demonstrates a broader concern for Windows endpoint security.

Traditional BYOVD attacks depend on vulnerable third-party drivers. Security vendors can respond by identifying those drivers and adding them to blocklists.

BTR Reforged demonstrates another approach:

Instead of bringing a vulnerable driver onto the machine, an attacker can potentially abuse a trusted driver that is already part of the operating system.

This shifts the defensive challenge from identifying malicious drivers to detecting legitimate security components being used outside their intended operational context.

For defenders, monitoring privileged driver-loading activity, unusual boot-time registry modifications, suspicious BTR.sys transactions, and unexpected PID 4 file operations may therefore become increasingly important.

Check Point Research said Microsoft has not planned a patch for the technique, while Microsoft had not publicly confirmed that characterization at the time of publication.