# Weaponizing Defender's BTR.sys to Disable Security Software

> Attackers can weaponize a legitimate Microsoft Defender driver to delete security software at boot, impacting Windows 7-11.

- Published: 2026-08-22T08:17:55.000Z
- Severity: medium
- Category: Vulnerabilities
- Tags: Microsoft Defender, Kernel Driver, Defense Evasion, Check Point Research, Windows Security
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/08/microsoft-defenders-own-driver-can-be.html
- Canonical: https://runtimerebel.com/blog/weaponizing-defender-s-btr-sys-to-disable-security-software

## Key points

- Attackers can weaponize a legitimate Microsoft Defender driver to delete security software at boot, bypassing blocks.
- All Windows systems from Windows 7 through Windows 11 25H2 are affected by this defense evasion technique.
- Restrict SeLoadDriverPrivilege and monitor for specific Sysmon/Windows events to detect potential BTR.sys abuse.

## Overview: Weaponizing Microsoft Defender's BTR.sys

Check Point Research has disclosed a novel technique that allows threat actors with administrative privileges to weaponize a legitimate Microsoft Defender component, `BTR.sys` (Boot Time Removal Tool), to delete security software at boot time. This method bypasses traditional blocking mechanisms and impacts Windows systems from Windows 7 through Windows 11 25H2. While not a [vulnerability](/glossary#vulnerability) in the traditional sense, but rather an architectural trust boundary issue, this technique enables sophisticated [defense evasion](/glossary#defense-evasion) by attackers who have already gained administrator access, posing a significant challenge for [endpoint](/glossary#endpoint) security. According to [The Hacker News](https://thehackernews.com/2026/08/microsoft-defenders-own-driver-can-be.html), Check Point Research found no evidence of this specific technique being used in real-world attacks, suggesting an opportunity for proactive defense engineering.

## Technical Analysis of BTR.sys Exploitation

The `BTR.sys` driver is an essential Windows component, embedded within Defender's `MpEngine.dll`. Its primary function is to complete [malware](/glossary#malware) remediation tasks, such as deleting locked files or registry entries, during the boot process when user-mode services have not yet fully started. This "golden window" allows `BTR.sys` to perform kernel-level operations (Ring 0) with system privileges.

Check Point Research reverse-engineered the driver's undocumented transaction protocol. They discovered that configuration blobs passed to `BTR.sys` are RC4-encrypted using a hard-coded 256-byte key, consistent across all `BTR.sys` builds since Windows 7. Researchers developed a proof-of-concept tool, `BTR_CLI`, which extracts the `BTR.sys` binary and constructs valid encrypted transactions.

The `BTR_CLI` tool installs `BTR.sys` as a service by directly writing to the `HKLM` registry, bypassing the Service Control Manager and avoiding the generation of a Windows Event ID 7045 (Service Installed). Once loaded, the driver executes queued operations, including deleting locked files and directories, moving files to unconstrained paths like `System32\drivers`, and manipulating registry keys. Critically, these operations are attributed to the System process (PID 4) in telemetry, complicating detection.

The technique allows for the physical removal of core security binaries, such as `WdFilter.sys` and `MsMpEng.exe`, before they can lock themselves, effectively disabling Microsoft Defender. This method requires an administrator account with `SeLoadDriverPrivilege`. Unlike "bring your own vulnerable driver" attacks, which rely on external, blocklistable drivers, this `BTR Reforged` technique leverages a built-in, legitimately signed Windows component, making it difficult to block without impacting system functionality. Microsoft Security Response Center (MSRC) confirmed that this finding does not meet their criteria for immediate servicing, as it relies on pre-existing administrative privileges. This clarification emphasizes the importance of understanding the privilege requirements for `weaponizing Microsoft Defender BTR.sys`.

It is worth noting that `BTR.sys` has been previously examined by security researchers. In February 2021, SentinelLabs disclosed [CVE-2021-24092](https://nvd.nist.gov/vuln/detail/CVE-2021-24092), a [privilege escalation](/glossary#privilege-escalation) vulnerability in the same driver that allowed a local non-administrator to overwrite arbitrary files. This previous flaw was patched by Microsoft, but it highlights the historical interest in this particular driver.

## Mitigation and Detection: How to Detect BTR.sys Abuse

Given that this technique relies on pre-existing administrative privileges, primary [hardening](/glossary#hardening) controls should focus on restricting such access. Check Point Research specifically recommends **restricting the assignment of `SeLoadDriverPrivilege`** as a key mitigation. Organizations should regularly review and limit which accounts possess this sensitive privilege.

For detection, Check Point Research identified specific Sysmon and Windows event conditions as indicators of potential `BTR.sys` abuse. Security teams should implement monitoring for:

*   Unusual loading of `BTR.sys` as a service outside of expected Defender remediation activities. This can be challenging due to the direct registry write method bypassing standard service installation events.
*   File deletions or modifications targeting security software binaries (e.g., `WdFilter.sys`, `MsMpEng.exe`) occurring during the boot phase.
*   Registry key modifications related to service installation (e.g., `HKLM\SYSTEM\CurrentControlSet\Services\BTR.sys`) that do not align with normal system behavior.
*   Processes attributed to System (PID 4) performing unexpected file or registry operations that impact security components, especially those occurring shortly after system boot.

Proactive [detection engineering](/glossary#detection-engineering) is feasible as this technique is not yet observed in the wild. Defenders should analyze their endpoint telemetry for these anomalies and consider deploying solutions that can inspect low-level system activity during the boot process. Understanding and monitoring these indicators can help organizations `detect BTR.sys abuse` before it becomes widespread.

**Related:** [Microsoft Defender 'RoguePlanet' Zero-Day Grants SYSTEM Privileges](/blog/microsoft-defender-rogueplanet-zero-day-grants-system-privileges), [Microsoft Defender RoguePlanet Zero-Day Vulnerability Patching Guide](/blog/microsoft-defender-rogueplanet-zero-day-vulnerability-patching-guide)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/weaponizing-defender-s-btr-sys-to-disable-security-software