Microsoft’s built-in Windows Defender remediation driver BTR.sys can be turned into a powerful kernel-level tool for deleting security software during boot, without exploiting any vulnerability or loading an external driver, according to new research from Check Point.[1][2][9] The technique works across Windows versions from 7 through Windows 11 25H2 and abuses a legitimately signed component that ships with every modern install of Microsoft Defender.[1][2][9] Because the driver is functioning as designed, there is currently no CVE assigned and no patch expected, raising difficult questions for defenders about how to mitigate a trusted engine that can be weaponized against them.[4][8][9]
BTR.sys, short for Boot Time Removal Tool, is a one-shot kernel driver that Windows Defender invokes during reboot-based malware cleanup to perform file and registry operations at Ring 0.[2][6][13] The driver reads an RC4-encrypted transaction list from an alternate data stream on disk using a hardcoded key that has remained consistent across builds from Windows 7 through Windows 11 25H2.[2][5][9] Once loaded, BTR.sys decrypts the instruction block and carries out queued actions attributed to the System process (PID 4), including deleting locked files and directories, moving files into sensitive paths such as System32drivers, removing registry keys and values, and writing new registry data of any type.[1][2][3]
Check Point’s analysis shows that an attacker who already has administrative access and the SeLoadDriverPrivilege right can craft their own valid encrypted configuration and hijack BTR.sys for arbitrary kernel operations.[2][3][5] The proof-of-concept tool BTR_CLI extracts BTR.sys from MpEngine.dll within Defender’s definition updates, builds a syntactically correct encrypted transaction file, and then installs the driver as a transient service directly via registry writes with Type=1, Start=1, and load order group “Boot Bus Extender” so it executes in the early boot phase.[2][3][9][15] Running at that moment, before user-mode protections and many EDR components initialize, BTR.sys can delete AV and EDR binaries, disable tamper protection controls, drop malicious drivers, and establish persistence, all while appearing as legitimate Defender activity originating from the System process.[1][2][5][8]
This is not the first time BTR.sys has drawn scrutiny from researchers, but the newly described abuse is fundamentally different from the earlier privilege escalation flaw tracked as CVE-2021-24092.[6][13] CVE-2021-24092 allowed attackers to overwrite arbitrary files via a hard link trick during Defender’s cleanup routine and was patched in the Microsoft Malware Protection Engine, starting with version 1.1.17800.5.[6][13] In contrast, the current technique does not rely on a bug in BTR.sys; instead, it leverages the driver’s intended transaction protocol and encryption scheme to drive Defender’s own kernel cleanup engine with attacker-supplied instructions.[2][9] Because BTR.sys is a required Windows component, it cannot simply be added to Microsoft’s Vulnerable Driver Blocklist or blocked via Windows Defender Application Control (WDAC) without breaking core malware remediation functionality.[1][9] Microsoft’s security response team has reportedly concluded that the need for administrative privileges means the issue does not require immediate servicing, leaving organizations to compensate at the configuration and monitoring layers.[4][8]
For attackers who have already achieved local admin rights, BTR.sys offers a built-in alternative to “bring your own vulnerable driver” tactics that many defenders now attempt to block.[2][7][9] By abusing a first-party, Microsoft-signed driver that is trusted by WDAC and driver blocklists, adversaries can perform surgical pre-boot removal of agent components, logs, and policy artifacts that would otherwise record or prevent their activity.[1][2][5] Public discussion of the technique has already extended beyond conference stages and blogs, with an offensive proof-of-concept for BTR.sys shared on social media and linked to a GitHub repository that implements the transaction protocol as a red-team tool.[2][15] While there is no public evidence yet of widespread in-the-wild exploitation, the combination of broad platform coverage, WDAC immunity, and mature tooling makes BTR.sys an attractive primitive for ransomware operators and advanced intrusion sets once they have a foothold.[1][2][5]
In the absence of a vendor fix, defenders need to focus on limiting who can reach the preconditions for abuse and on spotting the telltale artifacts of manipulated boot-time remediation.[4][8][9] Locking down administrative accounts and restricting SeLoadDriverPrivilege to the smallest possible set of identities reduces the chance that an attacker can load arbitrary kernel drivers in the first place.[2][5][8] Security teams should monitor for unexpected system-start services in the “Boot Bus Extender” group, anomalous early-boot driver loads referencing BTR.sys, and unusual file and registry deletions attributed to the System process during startup.[2][3][9] Ensuring that endpoints run current versions of the Microsoft Malware Protection Engine remains important to stay protected from older vulnerabilities such as CVE-2021-24092, but even fully patched systems are still exposed to this design-level abuse of Defender’s remediation driver.[6][13] Layered controls—including strong EDR visibility into boot-time activity, hardened driver loading policies, and rigorous privilege management—will be essential to keeping Microsoft’s own cleanup tool from becoming an attacker’s favorite kernel scalpel.
References
- Microsoft Defender’s Own Driver Can Be Weaponized to Delete …
- BTR Reforged: Weaponizing Defender’s Remediation Driver as a …
- BTR.sys in Microsoft Defender: signierter Treiber löscht Security beim Boot
- Black Hat 2026: Check Point Research Takes the Stage
- blackorbird
- 12-year-old Windows Defender bug gives hackers admin rights
- ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More
- Lewis Combs’ Post – LinkedIn
- Day 2 at Black Hat: Check Point Research Takes the Stage
- CVE-2021-24092: 12 Years in Hiding – A Privilege Escalation …
- Offensive PoC tool for BTR.sys
