Check Point Research presents a full reverse engineering of Windows Defender's Boot-Time Removal driver (BTR.sys), revealing how this legitimate, Microsoft-signed kernel driver can be weaponized as an attacker-controlled kernel primitive. By decrypting its proprietary RC4-encrypted transaction format and mapping its binary protocol, researchers built BTR_CLI — a PoC tool that constructs valid encrypted payloads to instruct BTR.sys to perform arbitrary file and registry operations from Ring 0. The technique exploits a 'Golden Window' during Windows boot (Phase 1, Boot Bus Extender group) where the filesystem is active but EDR user-mode services haven't started, enabling deletion of Defender binaries and service registry keys, bypassing Tamper Protection. All 18 analyzed BTR.sys versions share the same hard-coded RC4 key and protocol structure, making the technique work across Windows 7 through Windows 11 25H2. MSRC classified this as a LOLDriver rather than a vulnerability since it requires SeLoadDriverPrivilege. Detection relies on ADS monitoring (Sysmon Event ID 15 for .sys:changelist streams), behavioral attribution of System PID 4 file deletions, and driver load lineage analysis.
Table of contents
AbstractIntroductionTechnical Analysis: The BTR DriverThe Transaction StructureWeaponized Primitives (Action IDs)Operational Findings & Anti-ForensicsBTR.sys Driver VersionsThe Tool: BTR_CLIThe “Golden Window” of Opportunity: Exploiting the BTR.sys Driver for EDR/AV NeutralizationDemo PoC: BTR_CLI – WIN 11 25H2 – KILL CHAINDetection & MitigationConclusionQuestions this post answers
What is BTR.sys in Windows Defender and can it be abused by attackers?
BTR.sys is the Windows Defender Boot-Time Removal driver, dropped by MpEngine.dll with a randomized filename when remediation requires a reboot. It reads an RC4-encrypted configuration blob from an Alternate Data Stream and executes arbitrary file and registry operations from Ring 0. All 18 analyzed Microsoft-signed versions share the same hard-coded 256-byte RC4 key and protocol structure, making it usable as a kernel primitive across Windows 7 through Windows 11 25H2. Security engineers tracking LOLDriver techniques and EDR bypass research follow developments like this on daily.dev.
How does the BTR.sys Golden Window EDR bypass work during Windows boot?
BTR.sys configured as Start=1 in the 'Boot Bus Extender' load group executes at the very start of Phase 1, after Ntfs.sys initializes but before user-mode security services like MsMpEng.exe start. This gap — measured at roughly 3.5 minutes before Defender's service loads — allows BTR.sys to delete protected binaries such as WdFilter.sys and MsMpEng.exe and remove their service registry keys, blinding the OS on the next reboot. Teams hardening Windows endpoints against boot-time attacks track research like this on daily.dev.
How can I detect BTR.sys abuse using Sysmon?
Primary detection uses Sysmon Event ID 15 (FileCreateStreamHash) where TargetFilename ends in .sys:changelist, capturing the RC4-encrypted payload in the Contents field. Secondary signals include Event ID 6 (DriverLoad) with a Microsoft Windows signature matching known BTR.sys hashes but with a non-Defender parent process, and RegistryEvent (Event ID 12/13) creating a service key with an Args value containing :changelist and Group set to Boot Bus Extender without an accompanying Service Installation event (System Event ID 7045). Detection engineers building Sysmon rules for kernel-level threats share and refine coverage on daily.dev.