Researchers Show How Windows Defender’s BTR.sys Driver Can Be Abused to Disable Security Tools
Summary
Check Point researchers reverse-engineered Microsoft’s signed BTR.sys remediation driver and demonstrated that attackers with load-driver privileges can use it for kernel-level file and registry operations, including disabling security tools. No real-world abuse was||||
Key points
- BTR.sys, embedded in Windows Defender’s MpEngine.dll, performs boot-time remediation and accepts encrypted transaction instructions through an alternate data stream.
- Researchers reverse-engineered its RC4-encrypted format and built BTR_CLI to invoke file deletion, file moves, and registry operations from kernel mode.
- The driver can run early in system startup, before Defender’s user-mode service starts, creating an opportunity to disable security components.
- Tests demonstrated deletion of Defender files and service registry keys, bypassing Tamper Protection; the technique requires administrative privileges, including SeLoadDriverPrivilege.
- The research describes behavioral detections using Sysmon events for ADS writes, driver loads, registry service-key creation, and file deletion.
- Researchers found no evidence of real-world abuse in the samples and telemetry they examined.
- Microsoft’s MSRC said the findings do not meet criteria for immediate servicing because the technique relies on pre-existing administrative privileges.
Article Details
- Attack Vectors
- An operator with administrative privileges and SeLoadDriverPrivilege can use BTR_CLI to stage the Microsoft-signed BTR.sys driver and direct it to perform kernel-mode file and registry operations.
- For boot-time execution, BTR_CLI configures the driver as a system-start driver in the Boot Bus Extender group, allowing it to run after the filesystem is available but before later-loading security components and user-mode protection services.
- BTR_CLI can use BTR.sys to delete files, move files into protected directories, and delete or set registry keys and values; the article demonstrates deleting Defender components and moving mimidrv.sys into System32\drivers.
- The tool stores its encrypted transaction configuration in a :changelist Alternate Data Stream on the driver file and can direct the driver to delete BootClean.log and clean up its artifacts.
- Defensive Notes
- Restrict SeLoadDriverPrivilege according to least privilege and monitor assignment and use of the privilege.
- Detect driver loads based on process lineage and behavior, not signature alone; investigate BTR.sys loads where the driver was dropped outside the Defender ecosystem.
- Monitor Sysmon Event ID 15 for .sys:changelist streams and secondary .dat streams on driver files, and correlate driver loads with System (PID 4) file deletions and rapid BootClean.log creation and deletion.
- Monitor registry events for service keys with an Args value containing :changelist and Group set to Boot Bus Extender, especially when no standard service-installation event accompanies them.
- Use defense-in-depth beyond the Microsoft Vulnerable Driver Blocklist: the article notes that the blocklist does not prevent abuse of this built-in driver.
MITRE ATT&CK
T1070.004 · File DeletionBTR_CLI adds an action to delete BTR.sys's BootClean.log and removes its driver, service, and ADS artifacts after execution.T1112 · Modify RegistryBTR.sys can delete registry keys and values or set registry values; the demonstrations delete Defender service keys to bypass Tamper Protection.T1543.003 · Windows ServiceBTR_CLI directly creates a randomized driver service registry key and invokes NtLoadDriver; the article contrasts this with service creation through the Service Control Manager.T1547.006 · Kernel Modules and ExtensionsBTR_CLI can configure BTR.sys as a system-start driver in the Boot Bus Extender group so it runs during the next boot.T1562.001 · Disable or Modify ToolsThe demonstrated BTR.sys operations delete Defender binaries and service keys, preventing security components from loading.
People
Vendors
Products
Microsoft Defender Antimalware PlatformBy exploiting this load order gap, BTR.sys functions as a potent neutralizer for security solutions, including Microsoft Defender and potentially third-party EDRs.Microsoft WindowsIn this publication, we present the first full reverse engineering of the Windows Defender Boot-Time Removal driver (BTR.sys) and its proprietary transaction format.Windows DefenderIn this publication, we present the first full reverse engineering of the Windows Defender Boot-Time Removal driver (BTR.sys) and its proprietary transaction format.
Tools
BTR_CLIWe introduce BTR_CLI, a research tool that constructs valid encrypted transactions and safely exercises the driver’s functionality to demonstrate its capabilities.MimikatzWe attempt to extract a well-known driver universally classified as malicious (mimidrv.sys – part of the Mimikatz post-exploitation tool) and modify Defender registry keys using standard Administrator privileges. BothProcess MonitorBoot-time logging via Process Monitor provided definitive proof of this execution timeline.SysmonBased on telemetry analysis using Sysmon (System Monitor), robust detection must rely on behavioral context, Alternate Data Stream (ADS) monitoring, and kernel-execution attribution.