At a Glance Research BTR Reforged (Check Point Research) Component BTR.sys, the Windows Defender Boot-Time Removal driver Technique Repurposing a signed Microsoft driver into a kernel primitive Impact Arbitrary file and registry operations from Ring 0; EDR/AV bypass Requirement Pre-existing admin rights (SeLoadDriverPrivilege) In-the-wild status No real-world abuse observed at time of research Source Check Point Research write-up TL;DR Check Point researchers reverse-engineered BTR.sys, a signed Windows Defender remediation driver.

Cet article présente la première rétro-ingénierie complète du driver BTR.sys (Windows Defender Boot-Time Removal), un composant légitime signé Microsoft embarqué dans MpEngine.dll. L'analyse a débuté lors d'une investigation de réponse à incident où le driver avait été initialement confondu avec un artefact malveillant en raison de ses caractéristiques inhabituelles.

Check Point Research revealed that Microsoft Defender’s legitimately signed BTR.sys boot-time remediation driver can be abused for arbitrary kernel-level file and registry operations on Windows from Windows 7 through Windows 11 25H2. The technique, demonstrated with the BTR_CLI proof-of-concept, can remove security binaries in a “golden window” after reboot, while Check...

This research reverse engineers Windows Defender’s BTR.sys boot-time remediation driver and shows how its encrypted transaction format can be abused to perform arbitrary file and registry operations from Ring 0. The paper also introduces BTR_CLI, demonstrates EDR/AV bypass and boot-time neutralization against Microsoft Defender, and highlights the defensive implications of a signed built-in LOLDriver. #BTR.sys #BTR_CLI #MicrosoftDefender #MsMpEng.exe #WdFilter.sys #WdBoot.sys #WdNisDrv.sys #Mimikatz #mimidrv.sys #MSRC