Full Report
Research by: Jiří Vinopal (@vinopaljiri) Abstract What if a trusted security component could be repurposed into an attacker-controlled kernel primitive? What if a signed Microsoft remediation driver could be instructed to execute arbitrary file and registry operations from Ring 0 – without exploits, vulnerabilities, or memory corruption? In this publication, we present the first full […] The post BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive appeared first on Check Point Research.
Analysis Summary
# Technique: Weaponizing Defender’s Remediation Driver (BTR.sys)
## Overview
This technique involves repurposing the legitimate, Microsoft-signed **Windows Defender Boot-Time Removal driver (`BTR.sys`)** as a kernel operation primitive. Instead of exploiting a vulnerability, the technique leverages the driver's intended functionality—performing file and registry remediation at Ring 0—by crafting encrypted "transactions" (changelists) that the driver executes during the boot process.
## Technical Details
- **Type:** Technique / Tool (BTR_CLI)
- **Platform:** Windows (Kernel Mode)
- **Capabilities:** Arbitrary file and registry operations from Ring 0 using a trusted, signed driver.
- **First Seen:** August 2024 (Research publication date)
## MITRE ATT&CK Mapping
- **[TA0005 - Defense Evasion]**
- **[T1564.004 - Hide Artifacts: NTFS File Attributes]** (Use of Alternate Data Streams for configuration)
- **[T1553.002 - Subvert Trust Controls: Code Signing]** (Abusing legitimate Microsoft-signed drivers)
- **[TA0003 - Persistence]**
- **[T1543.003 - Create or Modify System Process: Windows Service]** (Temporary service creation for driver loading)
## Functionality
### Core Capabilities
- **Kernel-Level Execution:** Executes operations at Ring 0, bypassing standard User-Mode (Ring 3) restrictions.
- **File Operations:** Arbitrary creation, deletion, or modification of files on the system partition.
- **Registry Operations:** Modification of sensitive registry keys and values from the kernel.
- **Transaction-Based:** Uses a proprietary, encrypted binary format stored in an Alternate Data Stream (`:changelist`) to define actions.
### Advanced Features
- **EDR/AV Bypass:** Since the driver is a trusted component of Windows Defender, its activities may be ignored or "allow-listed" by security solutions, making it an effective alternative to Bring Your Own Vulnerable Driver (BYOVD) attacks.
- **Integrity Validation Subversion:** The research demonstrates how to satisfy the driver's internal integrity checks and encrypted configuration requirements.
## Indicators of Compromise
- **File Names:** `BTR.sys` (often found in `System32\drivers` with randomized filenames during active remediation).
- **Registry Keys:** Transient services in `HKLM\SYSTEM\CurrentControlSet\Services\` with randomized names and an `ImagePath` pointing to a driver in `System32\drivers`.
- **Behavioral Indicators:**
- Creation of services with the `Group` value set to `Boot Bus Extender`.
- Drivers interacting with an Alternate Data Stream named `:changelist`.
- Unusual file/registry modifications occurring early in the boot sequence.
## Associated Threat Actors
- **None currently identified:** This is primarily a security research discovery, though the techniques mirror those used by sophisticated APTs and rootkit developers.
## Detection Methods
- **Behavioral Detection:** Monitor for the creation of new services by non-standard processes, specifically those utilizing the `Boot Bus Extender` load order group.
- **Telemetry Analysis:** Audit EDR logs for instances of `BTR.sys` (or renamed versions) being loaded from non-standard locations or by processes other than legitimate Windows Defender components.
- **ADS Monitoring:** Detect the creation or modification of the `:changelist` Alternate Data Stream on driver files.
## Mitigation Strategies
- **Driver Signature Enforcement:** Ensure Windows is configured to only load drivers with valid, modern signatures (though this technique specifically uses a validly signed driver).
- **System Integrity:** Utilize Windows Defender Application Control (WDAC) to restrict driver loading to a known-good baseline.
- **Detection Engineering:** Implement specific alerts for the randomized service creation patterns and ADS usage described in the research.
## Related Tools/Techniques
- **BYOVD (Bring Your Own Vulnerable Driver):** Similar in goal (executing kernel-mode code) but differs because this technique uses a non-vulnerable, trusted driver.
- **Living off the Land (LotL):** This represents a "Living off the Land" approach for kernel-level persistence and evasion.