BTR Reforged: The Defender Driver as a Ring 0 Operation Primitive

BTR Reforged: The Defender Driver as a Ring 0 Operation Primitive

A researcher from Check Point reverse-engineered BTR.sys — the Microsoft-signed Windows Defender Boot-Time Removal driver. It turned out that the built-in functionality of the trusted Defender driver can be abused, turning it into a mechanism for arbitrary file and registry operations from Ring 0 — without exploiting vulnerabilities or memory corruption.

BTR.sys is used by Defender when eliminating a threat requires a reboot. The driver receives commands through a binary configuration stored in an Alternate Data Stream (:changelist), encrypted with RC4 using a hardcoded key and protected by a modified CRC32.

The author reconstructed the transaction format and available operations: • deletion and moving of files and directories; • deletion of registry keys and values; • arbitrary registry writes and registry creations.

The researcher discovered 18 unique 64-bit Microsoft-signed versions of BTR.sys with the same RC4 key and a consistent transaction format. The mechanism was successfully tested on systems ranging from Windows 7 SP1 to Windows 11 25H2.

Bypassing Defender and EDR When BTR.sys is loaded with Start=1 in the Boot Bus Extender group, the driver enters a “golden window”: the filesystem is already writable, while high-level security services and user-mode protection agents have not yet started. WdFilter.sys has already been loaded at this point, but operates in a limited capacity without MsMpEng.exe. On Windows 11 25H2, BTR.sys operations were performed approximately 34 seconds before MsMpEng.exe started. This made it possible to delete WdFilter.sys and MsMpEng.exe before Defender fully launched. The author also demonstrated bypassing Tamper Protection by deleting protected service registry keys from kernel mode. A similar approach could potentially be used against third-party EDRs.

PoC published Check Point released BTR_CLI under the MIT License. Unlike classic BYOVD, this does not require a vulnerable third-party driver: the tool extracts the built-in BTR.sys from the local MpEngine.dll, generates and encrypts transactions, creates an ADS, and loads the driver. The operations can be performed immediately or during the next Windows boot. Using the technique requires SeLoadDriverPrivilege. Since it relies on pre-existing administrative privileges, Microsoft Security Response Center concluded after reviewing the research that the findings did not meet the criteria for immediate servicing.

At the time of publication, the researchers had found no evidence of this technique being abused in the wild.

PoC (tool): https://github.com/Dump-GUY/BTR_CLI

Article: https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/