Windows Defender’s own driver can leave systems defenseless
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Check Point Research found that Windows Defender's own Boot-Time Removal driver (BTR.sys), a legitimate Microsoft-signed component, can be repurposed into a kernel-level 'operation engine' for arbitrary file deletion, file writes, and registry modification, without exploiting any vulnerability or requiring an external malicious driver like traditional BYOVD attacks. Researcher Jiří Vinopal reverse-engineered the driver's undocumented RC4-encrypted transaction format and built a proof-of-concept tool, BTR_CLI, that works from Windows 7 through Windows 11 25H2. Because BTR.sys can load early in boot Phase 1 before Defender's protection services start (roughly 34 seconds later), attackers get a 'Golden Window' to disable Defender itself. Microsoft's MSRC said the issue doesn't meet the bar for immediate servicing and that the technique requires pre-existing privileges. Signature-based detection won't catch this since the driver is legitimate; CPR recommends behavioral monitoring instead.
Questions this post answers
What is the BTR.sys driver in Windows Defender and how can it be abused?
BTR.sys is Microsoft's Boot-Time Removal driver, used legitimately by Windows Defender to delete locked files requiring a reboot. Check Point Research found it can be weaponized into a kernel-level operation engine by feeding it a crafted, RC4-encrypted transaction via an Alternate Data Stream, enabling arbitrary file deletion, file moves (including writes to System32), and registry modification without exploiting any vulnerability. Track kernel driver abuse research like this on daily.dev to keep endpoint defenses current.
How is this Windows Defender driver abuse different from a typical BYOVD attack?
Unlike Bring Your Own Vulnerable Driver attacks, which load an external malicious or vulnerable driver, this technique uses the target machine's own legitimate, Microsoft-signed BTR.sys driver already present in the Defender installation. The proof-of-concept tool BTR_CLI extracts the local driver, builds the encrypted transaction, and loads it, avoiding the need to introduce any outside driver at all. Compare emerging driver-abuse techniques against classic BYOVD on daily.dev while hardening endpoints.
Why does the timing of the BTR.sys driver during Windows boot matter for security?
BTR.sys can be configured as a Start=1 system driver in the Boot Bus Extender group, letting it run very early in boot Phase 1 when the filesystem is writable but security services haven't started yet. Check Point noted the primary antivirus service starts roughly 34 seconds after BTR.sys finishes, creating a 'Golden Window' where Defender binaries and registry keys can be deleted or modified before protection can launch. Follow boot-sequence security findings like this on daily.dev to spot gaps before attackers do.