**Check Point Research** has disclosed a sophisticated technique that weaponizes **Microsoft Defender's** own legitimately signed boot-time remediation driver, **BTR.sys** (Boot Time Removal Tool), to perform arbitrary kernel-level file and registry operations. This capability extends across **Windows 7** through **Windows 11 25H2**, crucially without exploiting any software flaw or importing external drivers. ### The Inherent Trust of BTR.sys **BTR.sys** is a mandatory **Windows** component, making it impossible to add to **Microsoft's Vulnerable Driver Blocklist** or block via **Windows Defender Application Control (WDAC)** without disrupting **Defender** itself. This inherent trust boundary is central to the 'BTR Reforged' technique. **Jiří Vinopal**, a threat researcher and reverse engineer at **Check Point Research**, presented these findings at **Black Hat USA 2026** and **DEF CON 34**. The accompanying research paper and a proof-of-concept tool, **BTR_CLI**, were released on August 20, 2026. ### No Evidence of In-the-Wild Exploitation (Yet) **Check Point Research** stated that their analysis found no evidence of this technique being used in real-world attacks. This suggests that 'BTR Reforged' is currently unknown or unused by threat actors, offering a window for proactive detection engineering before weaponization emerges. ### How BTR.sys is Weaponized **BTR.sys** is embedded within **Defender's** `MpEngine.dll` as the `BOOTTIMETOOL` resource. Its legitimate purpose is to finalize malware removal after a reboot, deleting files or registry entries that were locked during runtime. Vinopal reverse-engineered the driver's proprietary, undocumented transaction protocol. He discovered that every configuration blob passed to **BTR.sys** is **RC4-encrypted** with a 256-byte key hard-coded in the `.rdata` section of every **BTR.sys** build since **Windows 7**. #### The BTR_CLI Proof-of-Concept The **BTR_CLI** tool locates `MpEngine.dll` under **Defender's Definition Updates** and extracts the embedded **BTR.sys** binary. It then constructs a valid encrypted transaction and installs the driver as a service via direct **HKLM** registry writes, bypassing the **Service Control Manager** entirely and avoiding **Windows Event ID 7045** (Service Installed) entries. Once loaded, **BTR.sys** executes queued operations from **Ring 0**, attributed in telemetry to the **System process (PID 4)**. This allows it to: * Delete locked files and directories. * Move files to unconstrained paths, including `System32\drivers`. * Delete registry keys and values. * Write new registry values of any type. A second trigger mode schedules these operations for the next reboot. ### The 'Golden Window' of Opportunity **BTR.sys** operates during what Vinopal calls the "golden window" – the interval after the filesystem becomes writable but before **Defender's** user-mode services have started. This allows **BTR.sys** to physically remove security binaries like `WdFilter.sys` and `MsMpEng.exe` before they can lock themselves. A live demonstration at **Black Hat** showed **BTR_CLI** deleting the entire **Defender** stack from a fully updated **Windows 11 25H2** machine with **Tamper Protection** active. ### Administrative Privileges Required Exploitation requires an administrator account with `SeLoadDriverPrivilege`, which **BTR_CLI** auto-enables for accounts that already possess it. Unlike 'bring your own vulnerable driver' (**BYOVD**) attacks that rely on known-vulnerable third-party drivers, 'BTR Reforged' utilizes a driver built into every **Windows** installation. **Microsoft Security Response Center (MSRC)** has confirmed that these findings do not meet the criteria for immediate servicing, as the technique relies on pre-existing administrative privileges. **Check Point Research's** paper states, "No patch is planned," though **Microsoft** has not publicly confirmed this position. ### Past Scrutiny and Future Implications **BTR.sys** has been examined by researchers before. In February 2021, **SentinelLabs** researcher **Kasif Dekel** disclosed **CVE-2021-24092**, a privilege escalation vulnerability that **Microsoft** patched. The current technique, however, differs significantly. The use of a built-in **Windows** driver as a kernel offensive primitive has been seen before, notably with **FIN7's AvNeutralizer**, which weaponized `ProcLaunchMon.sys` to tamper with endpoint security software. ### Origin and Detection Guidance This research originated during an incident response investigation where suspicious endpoint telemetry was ultimately traced back to legitimate **Windows Defender** remediation activity. **Check Point Research** has identified several **Sysmon** and **Windows** event conditions as indicators of potential **BTR.sys** abuse: * **Sysmon Event ID 15** (FileCreateStreamHash) where the target filename ends in `.sys:changelist`. * **RegistryEvent** (Sysmon Event ID 12 or 13) creating a service key whose `Args` value contains `:changelist` and whose `Group` is "Boot Bus Extender," especially without a **Windows Event ID 7045**. * **Sysmon Event IDs 11** (FileCreate) and **23** (FileDelete) logging the rapid creation and deletion of `\SystemRoot\Temp\BootClean.log` by the **System process (PID 4)**. * **Sysmon Event ID 6** (DriverLoad) immediately followed by **Sysmon Event ID 23** (FileDelete) attributed to the **System process (PID 4)**. Restricting the assignment of `SeLoadDriverPrivilege` is recommended as the primary hardening control. The **BTR_CLI** tool is available on **GitHub** at [github.com/Dump-GUY/BTR_CLI](https://github.com/Dump-GUY/BTR_CLI) under the **MIT** license.