MEDIUM Vulnerabilities #Microsoft Defender #Windows Security

Weaponizing Defender's BTR.sys to Disable Security Software

2026-08-22 08:17 UTC 4 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Attackers can weaponize a legitimate Microsoft Defender driver to delete security software at boot, bypassing blocks.
All Windows systems from Windows 7 through Windows 11 25H2 are affected by this defense evasion technique.
Restrict SeLoadDriverPrivilege and monitor for specific Sysmon/Windows events to detect potential BTR.sys abuse.

Overview: Weaponizing Microsoft Defender’s BTR.sys

Check Point Research has disclosed a novel technique that allows threat actors with administrative privileges to weaponize a legitimate Microsoft Defender component, BTR.sys (Boot Time Removal Tool), to delete security software at boot time. This method bypasses traditional blocking mechanisms and impacts Windows systems from Windows 7 through Windows 11 25H2. While not a vulnerability in the traditional sense, but rather an architectural trust boundary issue, this technique enables sophisticated defense evasion by attackers who have already gained administrator access, posing a significant challenge for endpoint security. According to The Hacker News, Check Point Research found no evidence of this specific technique being used in real-world attacks, suggesting an opportunity for proactive defense engineering.

Technical Analysis of BTR.sys Exploitation

The BTR.sys driver is an essential Windows component, embedded within Defender’s MpEngine.dll. Its primary function is to complete malware remediation tasks, such as deleting locked files or registry entries, during the boot process when user-mode services have not yet fully started. This “golden window” allows BTR.sys to perform kernel-level operations (Ring 0) with system privileges.

Check Point Research reverse-engineered the driver’s undocumented transaction protocol. They discovered that configuration blobs passed to BTR.sys are RC4-encrypted using a hard-coded 256-byte key, consistent across all BTR.sys builds since Windows 7. Researchers developed a proof-of-concept tool, BTR_CLI, which extracts the BTR.sys binary and constructs valid encrypted transactions.

The BTR_CLI tool installs BTR.sys as a service by directly writing to the HKLM registry, bypassing the Service Control Manager and avoiding the generation of a Windows Event ID 7045 (Service Installed). Once loaded, the driver executes queued operations, including deleting locked files and directories, moving files to unconstrained paths like System32\drivers, and manipulating registry keys. Critically, these operations are attributed to the System process (PID 4) in telemetry, complicating detection.

The technique allows for the physical removal of core security binaries, such as WdFilter.sys and MsMpEng.exe, before they can lock themselves, effectively disabling Microsoft Defender. This method requires an administrator account with SeLoadDriverPrivilege. Unlike “bring your own vulnerable driver” attacks, which rely on external, blocklistable drivers, this BTR Reforged technique leverages a built-in, legitimately signed Windows component, making it difficult to block without impacting system functionality. Microsoft Security Response Center (MSRC) confirmed that this finding does not meet their criteria for immediate servicing, as it relies on pre-existing administrative privileges. This clarification emphasizes the importance of understanding the privilege requirements for weaponizing Microsoft Defender BTR.sys.

It is worth noting that BTR.sys has been previously examined by security researchers. In February 2021, SentinelLabs disclosed CVE-2021-24092, a privilege escalation vulnerability in the same driver that allowed a local non-administrator to overwrite arbitrary files. This previous flaw was patched by Microsoft, but it highlights the historical interest in this particular driver.

Mitigation and Detection: How to Detect BTR.sys Abuse

Given that this technique relies on pre-existing administrative privileges, primary hardening controls should focus on restricting such access. Check Point Research specifically recommends restricting the assignment of SeLoadDriverPrivilege as a key mitigation. Organizations should regularly review and limit which accounts possess this sensitive privilege.

For detection, Check Point Research identified specific Sysmon and Windows event conditions as indicators of potential BTR.sys abuse. Security teams should implement monitoring for:

Unusual loading of BTR.sys as a service outside of expected Defender remediation activities. This can be challenging due to the direct registry write method bypassing standard service installation events.
File deletions or modifications targeting security software binaries (e.g., WdFilter.sys, MsMpEng.exe) occurring during the boot phase.
Registry key modifications related to service installation (e.g., HKLM\SYSTEM\CurrentControlSet\Services\BTR.sys) that do not align with normal system behavior.
Processes attributed to System (PID 4) performing unexpected file or registry operations that impact security components, especially those occurring shortly after system boot.

Proactive detection engineering is feasible as this technique is not yet observed in the wild. Defenders should analyze their endpoint telemetry for these anomalies and consider deploying solutions that can inspect low-level system activity during the boot process. Understanding and monitoring these indicators can help organizations detect BTR.sys abuse before it becomes widespread.

#Microsoft Defender #Windows Security

X/Twitter LinkedIn Reddit HN

← Back to Articles