Check Point Research has disclosed a technique demonstrating how Microsoft Defender’s legitimate boot time remediation driver, BTR.sys, can be used to perform arbitrary kernel level file and registry operations on Windows systems ranging from Windows 7 to Windows 11 version 25H2. The research was presented by threat researcher and reverse engineer Jiří Vinopal during Black Hat USA 2026 and DEF CON 34 in Las Vegas, alongside the publication of a research paper and a proof of concept tool named BTR CLI on August 20, 2026. According to Check Point Research, the technique does not rely on exploiting a software vulnerability or introducing an external driver into the system. Instead, it makes use of Microsoft Defender’s own signed boot time remediation driver, which is already included as a required Windows component. The researchers also stated that they found no evidence indicating the technique has been observed in real world attacks, suggesting that defenders have an opportunity to develop detection mechanisms before any potential misuse emerges.
According to the research, BTR.sys is embedded inside Defender’s MpEngine.dll as the Boot Time Tool resource and is automatically deployed whenever Microsoft Defender needs to remove files or registry entries that cannot be deleted while Windows is running. Vinopal reverse engineered the driver’s undocumented transaction protocol and discovered that configuration data sent to the driver is protected using RC4 encryption with a 256 byte key that has reportedly remained unchanged across 18 different 64 bit versions of the driver since Windows 7. The proof of concept tool extracts the embedded driver from MpEngine.dll, generates a valid encrypted transaction and installs the driver by directly writing service entries into the Windows registry instead of using the Service Control Manager. According to the researchers, this method avoids generating the standard Windows Event ID 7045 log associated with service installation. Once loaded, the driver performs queued operations from kernel mode through the System process, allowing actions such as deleting locked files and directories, moving files into locations including the Windows drivers directory, deleting registry keys and creating new registry values. The research explains that these operations can also be scheduled to execute during the next system reboot.
The researchers stated that the driver executes during what they describe as the period after the file system becomes writable but before Microsoft Defender user mode services have started. During this interval, BTR.sys can remove security related files before they become protected by running services. As part of a live demonstration at Black Hat USA 2026, the proof of concept tool reportedly removed the complete Microsoft Defender security stack from a fully updated Windows 11 version 25H2 system while Tamper Protection remained enabled. However, Check Point Research emphasized that successful execution requires administrative privileges together with SeLoadDriverPrivilege, which the proof of concept tool enables only for accounts that already possess the required permission. The researchers explained that this differs from bring your own vulnerable driver techniques because it uses a legitimate Windows component instead of relying on vulnerable third party signed drivers that can later be blocked. Microsoft Security Response Center confirmed during responsible disclosure that the findings do not meet the criteria for immediate servicing because the technique depends on existing administrator privileges rather than a software vulnerability. While the GitHub repository for BTR CLI states that no patch is planned, Microsoft has not publicly confirmed that position.
Check Point Research noted that BTR.sys had previously been examined by security researchers in 2021 when SentinelLabs disclosed CVE 2021 24092, a privilege escalation vulnerability that Microsoft later patched. The researchers explained that the current investigation originated during an incident response engagement where unusual endpoint telemetry was eventually traced to legitimate Microsoft Defender remediation activity. To help organizations detect potential misuse, Check Point Research identified several Sysmon and Windows event patterns that defenders should monitor, including file creation events involving encrypted changelist streams, unusual registry service creation using the Boot Bus Extender group, temporary BootClean log activity generated by the System process and driver loading followed by immediate file deletion. The company also recommended restricting the assignment of SeLoadDriverPrivilege as the primary hardening measure to reduce the possibility of abuse. At the time of publication, neither Microsoft nor Check Point Research had provided additional public comments in response to media requests regarding the technique.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
