Researchers Show How Microsoft Defender’s BTR.sys Driver Can Remove Security Software at Boot
Summary
Check Point researchers reverse-engineered Defender’s BTR.sys boot-remediation driver and showed BTR_CLI can use it for kernel-level file and registry changes, including deleting security software at reboot. It requires SeLoadDriverPrivilege; no real-world abuse was—
Key points
- BTR.sys is embedded in Microsoft Defender and is present on Windows 7 through Windows 11 25H2; the technique uses a built-in driver rather than an externally imported driver or a software flaw.
- Researchers reverse-engineered the driver’s undocumented protocol, finding its configuration transactions use RC4 encryption with a hard-coded key.
- BTR_CLI extracts BTR.sys from Defender’s MpEngine.dll and installs it through direct registry writes, bypassing Service Control Manager installation logging, including Event ID 7045.
- The driver can perform kernel-level file and registry operations. A reboot trigger can run in a “golden window” before Defender’s user-mode services start, allowing security binaries to be removed.
- The technique requires an administrator account with SeLoadDriverPrivilege. Check Point demonstrated BTR_CLI removing Defender components from a fully updated Windows 11 25H2 system with Tamper Protection active.
- Check Point identified Sysmon and Windows event patterns that may indicate abuse and recommends restricting SeLoadDriverPrivilege.
- Check Point reported no evidence of real-world abuse. It said Microsoft did not consider the findings eligible for immediate servicing; a claim that no patch is planned appears in the tool repository and was not publicly confirmed by Microsoft.
Article Details
- Attack Vectors
- BTR_CLI extracts the embedded BTR.sys driver from MpEngine.dll and builds an encrypted transaction using the driver’s undocumented protocol.
- The technique requires an administrator account with SeLoadDriverPrivilege.
- BTR_CLI installs the driver service through direct HKLM registry writes, bypassing the Service Control Manager and its Event ID 7045 logging.
- BTR.sys can perform kernel-level file and registry operations, including deleting locked files and security binaries; a trigger can also schedule operations for the next reboot.
- Defensive Notes
- Check Point Research recommends restricting assignment of SeLoadDriverPrivilege.
- Monitor for Sysmon Event ID 15 writing a .sys:changelist stream, and service-key creation with an Args value containing :changelist and Group set to Boot Bus Extender, especially without Windows Event ID 7045.
- Monitor for rapid creation and deletion of SystemRootTempBootClean.log by the System process (PID 4), and for Sysmon Event ID 6 followed by Event ID 23 attributed to PID 4.
- Check Point Research says BTR.sys cannot be blocklisted or blocked with WDAC without disrupting Defender. The research says Microsoft MSRC did not consider the findings eligible for immediate servicing; the claim that no patch is planned comes from the BTR_CLI repository and is not publicly confirmed by Microsoft.
MITRE ATT&CK
T1112 · Modify RegistryBTR.sys can delete registry keys and values and write new registry values as part of the queued operations.T1543.003 · Windows ServiceBTR_CLI installs BTR.sys as a boot-start driver service using direct HKLM registry writes with Type=1, Start=1, and Group="Boot Bus Extender".T1562.001 · Disable or Modify ToolsThe technique can delete Microsoft Defender binaries, including WdFilter.sys and MsMpEng.exe, during the post-reboot interval before Defender user-mode services start.
CVE
People
Jiří VinopalCheck Point Research threat researcher and reverse engineer who reverse-engineered BTR.sys, presented the findings, and published the accompanying research and BTR_CLI proof of concept.Kasif DekelSentinelLabs researcher who disclosed CVE-2021-24092, a prior BTR.sys privilege-escalation flaw that Microsoft patched in 2021.
Vendors
Products
Microsoft Defender Antimalware PlatformCheck Point Research revealed that Microsoft Defender’s legitimately signed BTR.sys boot-time remediation driver can be abused for arbitrary kernel-level file and registry operations on Windows from Windows 7 throughMicrosoft Windowsboot-time remediation driver can be abused for arbitrary kernel-level file and registry operations on Windows from Windows 7 through Windows 11 25H2.
Tools
BTR_CLIThe technique, demonstrated with the BTR_CLI proof-of-concept, can remove security binaries in a “golden window” after reboot, while Check Point says it has seen no evidence of real-world abuse yet.SysmonCheck Point Research has identified the following Sysmon and Windows event conditions as indicators of potential BTR.sys abuse –