TL;DR
- what: Check Point Research disclosed BTR Reforged, a technique that loads Microsoft Defender's own signed boot-time remediation driver, BTR.sys, to run arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2.
- impact: An administrator with SeLoadDriverPrivilege can queue operations that run during boot and physically delete WdFilter.sys, MsMpEng.exe and other security binaries before Tamper Protection is enforced, leaving no Event ID 7045 behind.
- fix: There is no patch: MSRC ruled it out of scope for immediate servicing, so mitigation is detection engineering on the .sys:changelist Alternate Data Stream, Boot Bus Extender service key creation without a matching 7045, and restricting SeLoadDriverPrivilege.
- who: Every Windows endpoint from Windows 7 onward, with real risk concentrated in environments where attackers reach local administrator, since the driver is a required component that cannot be added to the Vulnerable Driver Blocklist or denied via WDAC.
Check Point Research has published a technique that turns Microsoft Defender's own boot-time remediation driver into a kernel-level file and registry deletion tool. A live demo at Black Hat USA 2026 removed the entire Defender stack from a fully patched Windows 11 25H2 machine with Tamper Protection enabled. No vulnerability was exploited, no third-party driver was dropped, and Microsoft's Security Response Center has said the findings do not meet the criteria for immediate servicing.
A required component, not a bring your own driver problem
BTR.sys, the Boot Time Removal Tool, ships inside Defender's MpEngine.dll as a resource named BOOTTIMETOOL. Defender extracts and loads it when a removal job cannot finish while Windows is running, for example when a malicious file or registry key is locked by a live process. The driver completes the cleanup on the next boot, then goes away. Because it does not normally sit on disk under a fixed name, it has drawn very little scrutiny.
That design is exactly what makes it useful to an attacker. Bring your own vulnerable driver campaigns depend on a signed third-party driver that Microsoft can add to the Vulnerable Driver Blocklist or that a defender can deny with Windows Defender Application Control. BTR.sys cannot be handled that way. It is a required Windows component present from Windows 7 through Windows 11 25H2, and blocking it breaks Defender's own remediation path. Jiri Vinopal of Check Point Research presented the work, which he calls BTR Reforged, as a main stage briefing at Black Hat USA 2026 and DEF CON 34, and published a proof of concept tool, BTR_CLI, on August 20, 2026.
One RC4 key, unchanged since Windows 7
The driver speaks a proprietary, undocumented transaction protocol. Every configuration blob handed to it is RC4 encrypted with a 256 byte key hard coded in the .rdata section of the binary. Vinopal checked 18 unique 64-bit BTR.sys builds and found the same key in all of them, covering every release since Windows 7. There is no per machine derivation, no rotation, and no nonce. Anyone who reverse engineers a single copy can forge valid transactions for every Windows machine in the field.
⚠️ The key is static across every shipped build — Eighteen 64-bit builds examined, one 256 byte RC4 key, zero changes since Windows 7. Nothing in the current design stops an attacker from crafting a valid encrypted transaction entirely offline, then delivering it to any host they already control.
Loading a kernel driver without calling the Service Control Manager
BTR_CLI locates MpEngine.dll under Defender's Definition Updates directory, carves out the embedded BTR.sys, builds an encrypted transaction, and registers the driver by writing directly to HKLM. That last step is the part detection teams should care about most.
- Type=1 and Start=1: registers a kernel driver that loads during boot rather than on demand
- Group set to Boot Bus Extender: places the driver in one of the earliest load groups, well ahead of user mode services
- Direct HKLM registry writes: the Service Control Manager is never called, so Windows never writes Event ID 7045, Service Installed
- Encrypted configuration stored in an Alternate Data Stream on the driver file, matching the pattern .sys:changelist
Once loaded, the driver executes queued operations from Ring 0. In telemetry those actions are attributed to the System process, PID 4. It can delete locked files and directories, delete registry keys and values, write new registry values of any type, and move files into unconstrained paths including System32\drivers.
The golden window
The second trigger mode is the dangerous one. Instead of acting immediately, BTR_CLI schedules the operations for the next reboot. Vinopal calls the resulting interval the golden window: the stretch of boot after the filesystem becomes writable but before Defender's user mode services have started. Inside that window nothing holds a lock on the security stack. BTR.sys deletes WdFilter.sys and MsMpEng.exe off the disk before they can protect themselves. Tamper Protection does not apply, because the components that enforce it have not started yet. The Black Hat demo showed exactly that on a fully updated Windows 11 25H2 host. The machine came back up with no Defender.
Prerequisites and Microsoft's position
This is a post-compromise capability, not an entry point. Exploitation requires an administrator account holding SeLoadDriverPrivilege, which BTR_CLI enables automatically for accounts that already have it granted. Check Point framed the issue as an architectural trust boundary rather than a memory safety bug, and MSRC agreed that it does not meet the criteria for immediate servicing on that basis. Vinopal's GitHub repository states that no patch is planned, a characterization Microsoft has not confirmed publicly.
No in the wild abuse observed yet — Check Point reviewed its collected samples and telemetry and found no evidence that BTR.sys has been abused this way in real attacks. That gives detection engineers a rare head start. FIN7's AvNeutralizer already weaponized built in drivers, ProcLaunchMon.sys alongside the Process Explorer driver, to tamper with endpoint security software, so the pattern has precedent.
Detection
Check Point published concrete Sysmon and Windows event conditions. None of them require a vendor update to deploy.
- Sysmon Event ID 15, FileCreateStreamHash, where the target filename ends in .sys:changelist. This catches the encrypted configuration being written to the driver's Alternate Data Stream.
- Sysmon Event ID 12 or 13, RegistryEvent, creating a service key whose Args value contains :changelist and whose Group is Boot Bus Extender.
- A new boot start kernel service key with no matching Windows Event ID 7045. That absence next to a new driver service is the strongest single signal here.
- Sysmon Event ID 11 and 23, file create and file delete, touching security product binaries such as WdFilter.sys and MsMpEng.exe and attributed to the System process at PID 4.
What to do this week
- Alert on the .sys:changelist string across file and registry telemetry. It is specific enough to run at low volume.
- Baseline Boot Bus Extender group membership per gold image, then alert on any addition. The list should be short and static.
- Treat a missing 7045 for a new service key as a finding, not as a logging gap.
- Audit who holds SeLoadDriverPrivilege. The technique needs it, and most administrator accounts do not need it for daily work.
- Add an EDR heartbeat check after every reboot. An agent that disappears across a restart should page someone, not surface in a weekly coverage report.
One more detail is worth keeping in view. BTR.sys was patched once before, in February 2021, for CVE-2021-24092, a SentinelLabs finding that let a local non-administrator overwrite arbitrary files through a hard link at the driver's log path. SentinelLabs noted then that the driver had escaped scrutiny because it is dropped under a random name and purged after use. Five years later the same property is doing the same work, and this time there is no patch date to wait for. The research itself began during an incident response engagement where suspicious kernel telemetry turned out to be legitimate Defender remediation.
Originally published on RedEye Threat Intelligence.
Top comments (0)