A curated index of Living Off the Land security research projects.

At a Glance Research BTR Reforged (Check Point Research) Component BTR.sys, the Windows Defender Boot-Time Removal driver Technique Repurposing a signed Microsoft driver into a kernel primitive Impact Arbitrary file and registry operations from Ring 0; EDR/AV bypass Requirement Pre-existing admin rights (SeLoadDriverPrivilege) In-the-wild status No real-world abuse observed at time of research Source Check Point Research write-up TL;DR Check Point researchers reverse-engineered BTR.sys, a signed Windows Defender remediation driver.

This research reverse engineers Windows Defender’s BTR.sys boot-time remediation driver and shows how its encrypted transaction format can be abused to perform arbitrary file and registry operations from Ring 0. The paper also introduces BTR_CLI, demonstrates EDR/AV bypass and boot-time neutralization against Microsoft Defender, and highlights the defensive implications of a signed built-in LOLDriver. #BTR.sys #BTR_CLI #MicrosoftDefender #MsMpEng.exe #WdFilter.sys #WdBoot.sys #WdNisDrv.sys #Mimikatz #mimidrv.sys #MSRC

Introduction: Living Off the Land (LOTL) attacks have become the cornerstone of modern adversarial tradecraft. By weaponizing legitimate, signed binaries (LOLBins), vulnerable kernel drivers (LOLDrivers), and dual-use remote management tools (RMM), attackers can bypass traditional antivirus and EDR solutions entirely. For a U.S.-based financial services firm with 1,500 Windows endpoints and a mature security posture that already included AppLocker and WDAC, the gap wasn't a lack of tools—it was the operational burden of managing prevention at scale.