Affected Systems

Microsoft Defender BTR.sys driver on all Windows versions from Windows 7 through Windows 11 25H2. The driver is a required component shipped with every Windows installation and cannot be blocked without breaking Defender functionality. Exploitation requires local administrator access with SeLoadDriverPrivilege.

Exploitation Status

Proof-of-concept tool (BTR_CLI) publicly released by Check Point Research on August 20, 2026, with full technical details presented at Black Hat USA 2026 and DEF CON 34. No evidence of real-world exploitation observed to date. Microsoft confirmed no patch is planned, as the technique requires pre-existing administrative privileges and does not meet servicing criteria.

Business Impact

Attackers with local administrator access can delete security software (including Defender itself with Tamper Protection active), install malicious drivers to System32\drivers, and manipulate registry keys at kernel level during boot—all attributed to System process (PID 4) with no Service Control Manager audit trail (no Event ID 7045). The technique bypasses traditional driver blocklists and WDAC policies because BTR.sys is a required Windows component. Detection is feasible but requires proactive telemetry engineering before threat actors adopt the technique.

Urgency

🟡 Within a week

Recommended Actions

  • Deploy Sysmon Event ID 15 (FileCreateStreamHash) monitoring for files ending in .sys:changelist to detect encrypted BTR.sys configuration streams being written.
  • Monitor Sysmon Event ID 12 (RegistryEvent) for direct HKLM registry writes creating services with Type=1, Start=1, and Group='Boot Bus Extender' that bypass Service Control Manager.
  • Alert on BTR.sys driver loads outside of legitimate Defender remediation context, correlating with Sysmon Event ID 6 (Driver Loaded) where ImageLoaded contains BTR.sys and is not triggered by MsMpEng.exe.
  • Restrict SeLoadDriverPrivilege to the minimum necessary accounts and audit privilege escalation attempts via Event ID 4672 (Special Privileges Assigned to New Logon).
  • Implement application control policies that log or block execution of tools extracting resources from MpEngine.dll, and review endpoint telemetry for suspicious MpEngine.dll file access patterns.

---

# Threat Actor Context

Actor Profile

This is not a threat actor report. Check Point Research is a cybersecurity research team that disclosed a novel attack technique ("BTR Reforged") that weaponizes Microsoft Defender's legitimately signed BTR.sys driver to perform arbitrary kernel-level operations on Windows systems. The technique was presented by Jiří Vinopal at Black Hat USA 2026 and DEF CON 34. Check Point found no evidence of real-world abuse, indicating the technique is currently unknown to threat actors. The disclosure originated from an incident response investigation where suspicious telemetry was traced back to legitimate Defender activity, prompting deeper analysis of the BTR.sys driver's capabilities.

TTPs (Tactics, Techniques, Procedures)

The BTR Reforged technique leverages the following capabilities: Initial Access & Privilege Requirements: Requires administrative account with SeLoadDriverPrivilege (T1078.002 - Domain Accounts, T1134 - Access Token Manipulation). Defense Evasion: Driver installation via direct HKLM registry writes (Type=1, Start=1, Group="Boot Bus Extender") bypasses Service Control Manager and generates no Event ID 7045 (T1112 - Modify Registry, T1562.001 - Disable or Modify Tools). Persistence & Execution: BTR.sys loads at boot as a kernel driver (T1543.003 - Windows Service, T1014 - Rootkit) and executes during the "golden window" before Defender services start. Impact: Arbitrary kernel-level file deletion including WdFilter.sys and MsMpEng.exe, registry manipulation, and file movement to System32\drivers (T1485 - Data Destruction, T1070.004 - File Deletion, T1112 - Modify Registry). Operations execute from Ring 0, attributed to System process (PID 4). The driver uses RC4-encrypted transaction protocol with hard-coded 256-byte key unchanged since Windows 7.

Targets & Patterns

The technique impacts technology and software security sectors broadly, as it affects all Windows systems from Windows 7 through Windows 11 25H2. The primary target is endpoint security software, specifically Microsoft Defender components (WdFilter.sys, MsMpEng.exe). The technique is particularly valuable to threat actors seeking to disable endpoint detection and response (EDR) capabilities on compromised systems where they have already obtained administrative privileges. Unlike traditional "bring your own vulnerable driver" (BYOVD) attacks that rely on blocklisted third-party drivers, BTR.sys is a required Windows component that cannot be blocked without disrupting Defender itself. This makes the technique attractive for post-compromise defense evasion in environments where attackers have achieved initial administrative access but need to neutralize security controls before executing final objectives. The technique was previously demonstrated conceptually with FIN7's AvNeutralizer tool, which weaponized Windows ProcLaunchMon.sys, suggesting advanced persistent threat groups and ransomware operators may adopt similar approaches.

Historical Context

BTR.sys was previously examined in February 2021 when SentinelLabs researcher Kasif Dekel disclosed CVE-2021-24092, a privilege escalation vulnerability allowing non-administrators to overwrite arbitrary files via hard link manipulation at the driver's log path. Microsoft patched that vulnerability on February 9, 2021. The current BTR Reforged technique disclosed by Check Point in August 2026 is architecturally different—it is not a software vulnerability but rather an abuse of legitimate driver functionality when administrative privileges are already present. Microsoft MSRC confirmed the findings do not meet criteria for immediate servicing, as the technique requires pre-existing SeLoadDriverPrivilege. The use of built-in Windows drivers as offensive primitives was previously demonstrated by FIN7's AvNeutralizer, which weaponized ProcLaunchMon.sys and Process Explorer drivers to tamper with endpoint security. Check Point's research originated from an incident response investigation where suspicious telemetry was traced to legitimate Defender remediation activity, prompting reverse engineering of BTR.sys's undocumented transaction protocol. The proof-of-concept tool BTR_CLI was released on August 20, 2026, alongside presentations at Black Hat USA 2026 and DEF CON 34.

Defensive Recommendations

  • Monitor Sysmon Event ID 15 (FileCreateStreamHash) for filenames ending in .sys:changelist, which captures the encrypted configuration Alternate Data Stream written to BTR.sys during weaponization attempts
  • Monitor Sysmon Event ID 12 (RegistryEvent) for direct HKLM registry writes creating services with Type=1, Start=1, and Group='Boot Bus Extender' that bypass Service Control Manager and generate no Event ID 7045
  • Alert on BTR.sys driver loads attributed to System process (PID 4) outside of legitimate Defender remediation workflows, particularly during the boot-time 'golden window' before Defender user-mode services start
  • Implement privileged access management controls to restrict SeLoadDriverPrivilege to only essential administrative accounts, and monitor for unauthorized privilege escalation attempts (T1134 - Access Token Manipulation)
  • Deploy file integrity monitoring on critical Defender binaries (WdFilter.sys, MsMpEng.exe) and System32\drivers directory to detect unauthorized deletion or modification attempts during boot sequences
  • Correlate MpEngine.dll access patterns with BTR.sys extraction attempts, as the proof-of-concept locates MpEngine.dll under Defender's Definition Updates to extract the embedded driver binary