--- title: Windows Defender’s own driver can leave systems defenseless description: Check Point Research found that Windows Defender's own Boot-Time Removal driver (BTR.sys), a legitimate Microsoft-signed component, can be repurposed into a... canonical: https://daily.dev/posts/windows-defender-s-own-driver-can-leave-systems-defenseless-efii1uurv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Windows Defender’s own driver can leave systems defenseless | daily.dev og:description: Check Point Research found that Windows Defender's own Boot-Time Removal driver (BTR.sys), a legitimate Microsoft-signed component, can be repurposed into a... og:url: https://daily.dev/posts/windows-defender-s-own-driver-can-leave-systems-defenseless-efii1uurv og:image: https://api.daily.dev/og/posts/efIi1Uurv.png og:image:alt: Windows Defender’s own driver can leave systems defenseless og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Windows Defender’s own driver can leave systems defenseless **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary Check Point Research found that Windows Defender's own Boot-Time Removal driver (BTR.sys), a legitimate Microsoft-signed component, can be repurposed into a kernel-level 'operation engine' for arbitrary file deletion, file writes, and registry modification, without exploiting any vulnerability or requiring an external malicious driver like traditional BYOVD attacks. Researcher Jiří Vinopal reverse-engineered the driver's undocumented RC4-encrypted transaction format and built a proof-of-concept tool, BTR_CLI, that works from Windows 7 through Windows 11 25H2. Because BTR.sys can load early in boot Phase 1 before Defender's protection services start (roughly 34 seconds later), attackers get a 'Golden Window' to disable Defender itself. Microsoft's MSRC said the issue doesn't meet the bar for immediate servicing and that the technique requires pre-existing privileges. Signature-based detection won't catch this since the driver is legitimate; CPR recommends behavioral monitoring instead. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the BTR.sys driver in Windows Defender and how can it be abused? BTR.sys is Microsoft's Boot-Time Removal driver, used legitimately by Windows Defender to delete locked files requiring a reboot. Check Point Research found it can be weaponized into a kernel-level operation engine by feeding it a crafted, RC4-encrypted transaction via an Alternate Data Stream, enabling arbitrary file deletion, file moves (including writes to System32), and registry modification without exploiting any vulnerability. _Track kernel driver abuse research like this on daily.dev to keep endpoint defenses current._ ### How is this Windows Defender driver abuse different from a typical BYOVD attack? Unlike Bring Your Own Vulnerable Driver attacks, which load an external malicious or vulnerable driver, this technique uses the target machine's own legitimate, Microsoft-signed BTR.sys driver already present in the Defender installation. The proof-of-concept tool BTR_CLI extracts the local driver, builds the encrypted transaction, and loads it, avoiding the need to introduce any outside driver at all. _Compare emerging driver-abuse techniques against classic BYOVD on daily.dev while hardening endpoints._ ### Why does the timing of the BTR.sys driver during Windows boot matter for security? BTR.sys can be configured as a Start=1 system driver in the Boot Bus Extender group, letting it run very early in boot Phase 1 when the filesystem is writable but security services haven't started yet. Check Point noted the primary antivirus service starts roughly 34 seconds after BTR.sys finishes, creating a 'Golden Window' where Defender binaries and registry keys can be deleted or modified before protection can launch. _Follow boot-sequence security findings like this on daily.dev to spot gaps before attackers do._ ## Similar posts on daily.dev - [BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive](https://daily.dev/posts/btr-reforged-weaponizing-defender-s-remediation-driver-as-a-kernel-operation-primitive-kmtmmxn82) · Check Point Research · 0 upvotes · 0 comments - [Microsoft Under Pressure to Bolster Defenses for BYOVD Attacks](https://daily.dev/posts/microsoft-under-pressure-to-bolster-defenses-for-byovd-attacks-98f7gahm1) · Dark Reading · 0 upvotes · 0 comments - [Windows 11's driver signature requirement is one of the best anti-consumer security features out there](https://daily.dev/posts/windows-11-s-driver-signature-requirement-is-one-of-the-best-anti-consumer-security-features-out-the-peze2jn3v) · XDA Developers · 0 upvotes · 0 comments - [How the GodDamn Ransomware Driver Bypasses Your EDR](https://daily.dev/posts/how-the-goddamn-ransomware-driver-bypasses-your-edr-6ruyzz7fu) · Latest Hacking News · 0 upvotes · 0 comments - ['BigDiskBuster' Leaves Microsoft Defender Running, Blocks Updates](https://daily.dev/posts/bigdiskbuster-leaves-microsoft-defender-running-blocks-updates-sf4giyv3r) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows) [View this post on daily.dev](https://daily.dev/posts/windows-defender-s-own-driver-can-leave-systems-defenseless-efii1uurv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Windows Defender’s own driver can leave systems defenseless","url":"https://daily.dev/posts/windows-defender-s-own-driver-can-leave-systems-defenseless-efii1uurv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/windows-defender-s-own-driver-can-leave-systems-defenseless-efii1uurv"},"datePublished":"2026-08-24T11:49:03.782Z","dateModified":"2026-08-25T11:49:46.778Z","description":"Check Point Research found that Windows Defender's own Boot-Time Removal driver (BTR.sys), a legitimate Microsoft-signed component, can be repurposed into a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5ba85f74f7f8bcedd947e072f4452109?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5ba85f74f7f8bcedd947e072f4452109?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/windows-defender-s-own-driver-can-leave-systems-defenseless-efii1uurv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,windows","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Windows Defender’s own driver can leave systems defenseless"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/windows-defender-s-own-driver-can-leave-systems-defenseless-efii1uurv#faq","mainEntity":[{"@type":"Question","name":"What is the BTR.sys driver in Windows Defender and how can it be abused?","acceptedAnswer":{"@type":"Answer","text":"BTR.sys is Microsoft's Boot-Time Removal driver, used legitimately by Windows Defender to delete locked files requiring a reboot. Check Point Research found it can be weaponized into a kernel-level operation engine by feeding it a crafted, RC4-encrypted transaction via an Alternate Data Stream, enabling arbitrary file deletion, file moves (including writes to System32), and registry modification without exploiting any vulnerability. Track kernel driver abuse research like this on daily.dev to keep endpoint defenses current."}},{"@type":"Question","name":"How is this Windows Defender driver abuse different from a typical BYOVD attack?","acceptedAnswer":{"@type":"Answer","text":"Unlike Bring Your Own Vulnerable Driver attacks, which load an external malicious or vulnerable driver, this technique uses the target machine's own legitimate, Microsoft-signed BTR.sys driver already present in the Defender installation. The proof-of-concept tool BTR_CLI extracts the local driver, builds the encrypted transaction, and loads it, avoiding the need to introduce any outside driver at all. Compare emerging driver-abuse techniques against classic BYOVD on daily.dev while hardening endpoints."}},{"@type":"Question","name":"Why does the timing of the BTR.sys driver during Windows boot matter for security?","acceptedAnswer":{"@type":"Answer","text":"BTR.sys can be configured as a Start=1 system driver in the Boot Bus Extender group, letting it run very early in boot Phase 1 when the filesystem is writable but security services haven't started yet. Check Point noted the primary antivirus service starts roughly 34 seconds after BTR.sys finishes, creating a 'Golden Window' where Defender binaries and registry keys can be deleted or modified before protection can launch. Follow boot-sequence security findings like this on daily.dev to spot gaps before attackers do."}}]} ```