--- title: BTR Reforged: Weaponizing Defender’s Remediation Driver... description: Check Point Research presents a full reverse engineering of Windows Defender's Boot-Time Removal driver (BTR.sys), revealing how this legitimate,... canonical: https://daily.dev/posts/btr-reforged-weaponizing-defender-s-remediation-driver-as-a-kernel-operation-primitive-kmtmmxn82 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive | daily.dev og:description: Check Point Research presents a full reverse engineering of Windows Defender's Boot-Time Removal driver (BTR.sys), revealing how this legitimate,... og:url: https://daily.dev/posts/btr-reforged-weaponizing-defender-s-remediation-driver-as-a-kernel-operation-primitive-kmtmmxn82 og:image: https://api.daily.dev/og/posts/kmtMmxn82.png og:image:alt: BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive **[Check Point Research](https://daily.dev/sources/cpresearch)** · 18 min read · 0 upvotes · 0 comments ## Summary Check Point Research presents a full reverse engineering of Windows Defender's Boot-Time Removal driver (BTR.sys), revealing how this legitimate, Microsoft-signed kernel driver can be weaponized as an attacker-controlled kernel primitive. By decrypting its proprietary RC4-encrypted transaction format and mapping its binary protocol, researchers built BTR_CLI — a PoC tool that constructs valid encrypted payloads to instruct BTR.sys to perform arbitrary file and registry operations from Ring 0. The technique exploits a 'Golden Window' during Windows boot (Phase 1, Boot Bus Extender group) where the filesystem is active but EDR user-mode services haven't started, enabling deletion of Defender binaries and service registry keys, bypassing Tamper Protection. All 18 analyzed BTR.sys versions share the same hard-coded RC4 key and protocol structure, making the technique work across Windows 7 through Windows 11 25H2. MSRC classified this as a LOLDriver rather than a vulnerability since it requires SeLoadDriverPrivilege. Detection relies on ADS monitoring (Sysmon Event ID 15 for .sys:changelist streams), behavioral attribution of System PID 4 file deletions, and driver load lineage analysis. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is BTR.sys in Windows Defender and can it be abused by attackers? BTR.sys is the Windows Defender Boot-Time Removal driver, dropped by MpEngine.dll with a randomized filename when remediation requires a reboot. It reads an RC4-encrypted configuration blob from an Alternate Data Stream and executes arbitrary file and registry operations from Ring 0. All 18 analyzed Microsoft-signed versions share the same hard-coded 256-byte RC4 key and protocol structure, making it usable as a kernel primitive across Windows 7 through Windows 11 25H2. _Security engineers tracking LOLDriver techniques and EDR bypass research follow developments like this on daily.dev._ ### How does the BTR.sys Golden Window EDR bypass work during Windows boot? BTR.sys configured as Start=1 in the 'Boot Bus Extender' load group executes at the very start of Phase 1, after Ntfs.sys initializes but before user-mode security services like MsMpEng.exe start. This gap — measured at roughly 3.5 minutes before Defender's service loads — allows BTR.sys to delete protected binaries such as WdFilter.sys and MsMpEng.exe and remove their service registry keys, blinding the OS on the next reboot. _Teams hardening Windows endpoints against boot-time attacks track research like this on daily.dev._ ### How can I detect BTR.sys abuse using Sysmon? Primary detection uses Sysmon Event ID 15 (FileCreateStreamHash) where TargetFilename ends in .sys:changelist, capturing the RC4-encrypted payload in the Contents field. Secondary signals include Event ID 6 (DriverLoad) with a Microsoft Windows signature matching known BTR.sys hashes but with a non-Defender parent process, and RegistryEvent (Event ID 12/13) creating a service key with an Args value containing :changelist and Group set to Boot Bus Extender without an accompanying Service Installation event (System Event ID 7045). _Detection engineers building Sysmon rules for kernel-level threats share and refine coverage on daily.dev._ ## Similar posts on daily.dev - [Windows Defender’s own driver can leave systems defenseless](https://daily.dev/posts/windows-defender-s-own-driver-can-leave-systems-defenseless-efii1uurv) · CSO Online · 0 upvotes · 0 comments - [How the GodDamn Ransomware Driver Bypasses Your EDR](https://daily.dev/posts/how-the-goddamn-ransomware-driver-bypasses-your-edr-6ruyzz7fu) · Latest Hacking News · 0 upvotes · 0 comments - [Microsoft Under Pressure to Bolster Defenses for BYOVD Attacks](https://daily.dev/posts/microsoft-under-pressure-to-bolster-defenses-for-byovd-attacks-98f7gahm1) · Dark Reading · 0 upvotes · 0 comments - [The Binary Hiding in Your Registry: Cracking Windows UCPD's Dynamic Rules](https://daily.dev/posts/the-binary-hiding-in-your-registry-cracking-windows-ucpd-s-dynamic-rules-xibiwebh7) · Binary Ninja · 0 upvotes · 0 comments --- Tags: [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/btr-reforged-weaponizing-defender-s-remediation-driver-as-a-kernel-operation-primitive-kmtmmxn82) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive","url":"https://daily.dev/posts/btr-reforged-weaponizing-defender-s-remediation-driver-as-a-kernel-operation-primitive-kmtmmxn82","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/btr-reforged-weaponizing-defender-s-remediation-driver-as-a-kernel-operation-primitive-kmtmmxn82"},"datePublished":"2026-08-20T13:08:17.138Z","dateModified":"2026-08-20T13:09:08.212Z","description":"Check Point Research presents a full reverse engineering of Windows Defender's Boot-Time Removal driver (BTR.sys), revealing how this legitimate,...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Check Point Research","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Check Point Research","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/7e3b130555214df2bf737ee6c764fa42","url":"https://daily.dev/sources/cpresearch"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/btr-reforged-weaponizing-defender-s-remediation-driver-as-a-kernel-operation-primitive-kmtmmxn82","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"reverse-engineering","timeRequired":"PT18M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Check Point Research","item":"https://daily.dev/sources/cpresearch"},{"@type":"ListItem","position":3,"name":"BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/btr-reforged-weaponizing-defender-s-remediation-driver-as-a-kernel-operation-primitive-kmtmmxn82#faq","mainEntity":[{"@type":"Question","name":"What is BTR.sys in Windows Defender and can it be abused by attackers?","acceptedAnswer":{"@type":"Answer","text":"BTR.sys is the Windows Defender Boot-Time Removal driver, dropped by MpEngine.dll with a randomized filename when remediation requires a reboot. It reads an RC4-encrypted configuration blob from an Alternate Data Stream and executes arbitrary file and registry operations from Ring 0. All 18 analyzed Microsoft-signed versions share the same hard-coded 256-byte RC4 key and protocol structure, making it usable as a kernel primitive across Windows 7 through Windows 11 25H2. Security engineers tracking LOLDriver techniques and EDR bypass research follow developments like this on daily.dev."}},{"@type":"Question","name":"How does the BTR.sys Golden Window EDR bypass work during Windows boot?","acceptedAnswer":{"@type":"Answer","text":"BTR.sys configured as Start=1 in the 'Boot Bus Extender' load group executes at the very start of Phase 1, after Ntfs.sys initializes but before user-mode security services like MsMpEng.exe start. This gap — measured at roughly 3.5 minutes before Defender's service loads — allows BTR.sys to delete protected binaries such as WdFilter.sys and MsMpEng.exe and remove their service registry keys, blinding the OS on the next reboot. Teams hardening Windows endpoints against boot-time attacks track research like this on daily.dev."}},{"@type":"Question","name":"How can I detect BTR.sys abuse using Sysmon?","acceptedAnswer":{"@type":"Answer","text":"Primary detection uses Sysmon Event ID 15 (FileCreateStreamHash) where TargetFilename ends in .sys:changelist, capturing the RC4-encrypted payload in the Contents field. Secondary signals include Event ID 6 (DriverLoad) with a Microsoft Windows signature matching known BTR.sys hashes but with a non-Defender parent process, and RegistryEvent (Event ID 12/13) creating a service key with an Args value containing :changelist and Group set to Boot Bus Extender without an accompanying Service Installation event (System Event ID 7045). Detection engineers building Sysmon rules for kernel-level threats share and refine coverage on daily.dev."}}]} ```