Full Report
Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine. The driver, BTR.sys (Boot Time Removal Tool), is a
Analysis Summary
# Tool/Technique: BTR Reforged (Weaponizing BTR.sys)
## Overview
BTR Reforged is a technique disclosed by Check Point Research that weaponizes Microsoft Defender’s legitimate, signed boot-time remediation driver (**BTR.sys**). By reverse-engineering the driver's proprietary transaction protocol, an attacker with administrative privileges can perform arbitrary kernel-level file and registry operations. Because the driver is a trusted Windows component, it cannot be easily blocklisted, allowing it to be used to disable security software (including Defender itself) during the "golden window" of the boot process before security services have initialized.
## Technical Details
- **Type**: Technique (Living-off-the-Land / Driver Abuse)
- **Platform**: Windows 7 through Windows 11 25H2
- **Capabilities**: Arbitrary kernel-level file deletion, file moving (to protected paths), and registry manipulation.
- **First Seen**: Disclosed August 20, 2026 (Black Hat USA 2026 / DEF CON 34).
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- T1562.001 - Impair Defenses: Disable or Modify Tools
- T1070.004 - Indicator Removal: File Deletion
- **TA0003 - Persistence**
- T1543.003 - Create or Modify System Process: Windows Service
- **TA0004 - Privilege Escalation**
- T1068 - Exploitation for Privilege Escalation (Abuse of legitimate kernel driver)
## Functionality
### Core Capabilities
- **Kernel-Level File Operations**: Can delete locked system files and directories or move files to unconstrained paths (e.g., moving a malicious payload into `System32\drivers`).
- **Registry Manipulation**: Can delete registry keys/values or write new values of any type at the kernel level.
- **Boot-Time Execution**: Operates during the "golden window" after the filesystem is writable but before user-mode security services (like `MsMpEng.exe`) start.
- **Ring 0 Execution**: Actions are performed from the kernel and attributed to the System process (PID 4) in telemetry.
### Advanced Features
- **Stealthy Service Installation**: BTR_CLI installs the driver via direct HKLM registry writes (`Type=1`, `Start=1`). This bypasses the Service Control Manager (SCM), resulting in no Windows Event ID 7045 (Service Installed) log entry.
- **Protocol Emulation**: Uses a hard-coded 256-byte RC4 key (consistent across 18 versions of Windows) to encrypt configuration blobs, allowing the tool to "speak" to the driver.
- **Self-Contained**: The technique does not require importing an external "vulnerable" driver; it extracts the legitimate BTR.sys already present in the system's Defender definitions.
## Indicators of Compromise
- **File Names**: `BTR.sys`, `BTR_CLI.exe` (PoC tool).
- **Registry Keys**:
- `HKLM\SYSTEM\CurrentControlSet\Services\BTR` (or other service names used to load the driver).
- Direct writes to `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager` for boot-time operations.
- **Behavioral Indicators**:
- Administrative accounts unexpectedly enabling `SeLoadDriverPrivilege`.
- The System process (PID 4) deleting known security binaries (e.g., `WdFilter.sys`, `MsMpEng.exe`) or EDR components at boot.
- Presence of the `BOOTTIMETOOL` resource extracted from `MpEngine.dll`.
## Associated Threat Actors
- No evidence of real-world abuse has been observed as of August 2026. The technique was developed and disclosed by Check Point Research.
## Detection Methods
- **Behavioral Detection**: Monitor for direct registry writes to the `Services` hive that bypass the SCM API.
- **Telemetry Analysis**: Audit use of `SeLoadDriverPrivilege` and subsequent driver loads not associated with standard update cycles.
- **File Integrity Monitoring**: Monitor for unauthorized modifications to Microsoft Defender's `MpEngine.dll` or extraction of its resources.
## Mitigation Strategies
- **Privilege Management**: Implement the Principle of Least Privilege (PoLP) to ensure users do not have local administrative rights or `SeLoadDriverPrivilege`.
- **Credential Guard**: Protect administrative credentials to prevent attackers from gaining the privileges required to trigger the driver.
- **Endpoint Monitoring**: Use EDR solutions to monitor for the specific "direct registry write" method of service installation that avoids Event ID 7045.
## Related Tools/Techniques
- **BYOVD (Bring Your Own Vulnerable Driver)**: Similar in goal, but BTR Reforged is more potent as it uses an *already present* and *unblockable* driver.
- **CVE-2021-24092**: An older privilege escalation vulnerability found in the same BTR.sys driver.
- **Living-off-the-Land (LotL)**: General category of using legitimate system tools for malicious purposes.