--- title: "Windows Defender’s own driver can leave systems defenseless" url: https://daily.dev/posts/windows-defender-s-own-driver-can-leave-systems-defenseless-efii1uurv source_url: https://www.csoonline.com/article/4212929/windows-defenders-own-driver-can-leave-systems-defenseless.html type: article source: "CSO Online" published: 2026-08-24T11:49:03.782Z updated: 2026-08-25T11:49:46.778Z tags: ["security", "windows"] reading_time: 4 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Windows Defender’s own driver can leave systems defenseless **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary Check Point Research found that Windows Defender's own Boot-Time Removal driver (BTR.sys), a legitimate Microsoft-signed component, can be repurposed into a kernel-level 'operation engine' for arbitrary file deletion, file writes, and registry modification, without exploiting any vulnerability or requiring an external malicious driver like traditional BYOVD attacks. Researcher Jiří Vinopal reverse-engineered the driver's undocumented RC4-encrypted transaction format and built a proof-of-concept tool, BTR_CLI, that works from Windows 7 through Windows 11 25H2. Because BTR.sys can load early in boot Phase 1 before Defender's protection services start (roughly 34 seconds later), attackers get a 'Golden Window' to disable Defender itself. Microsoft's MSRC said the issue doesn't meet the bar for immediate servicing and that the technique requires pre-existing privileges. Signature-based detection won't catch this since the driver is legitimate; CPR recommends behavioral monitoring instead. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the BTR.sys driver in Windows Defender and how can it be abused? BTR.sys is Microsoft's Boot-Time Removal driver, used legitimately by Windows Defender to delete locked files requiring a reboot. Check Point Research found it can be weaponized into a kernel-level operation engine by feeding it a crafted, RC4-encrypted transaction via an Alternate Data Stream, enabling arbitrary file deletion, file moves (including writes to System32), and registry modification without exploiting any vulnerability. _Track kernel driver abuse research like this on daily.dev to keep endpoint defenses current._ ### How is this Windows Defender driver abuse different from a typical BYOVD attack? Unlike Bring Your Own Vulnerable Driver attacks, which load an external malicious or vulnerable driver, this technique uses the target machine's own legitimate, Microsoft-signed BTR.sys driver already present in the Defender installation. The proof-of-concept tool BTR_CLI extracts the local driver, builds the encrypted transaction, and loads it, avoiding the need to introduce any outside driver at all. _Compare emerging driver-abuse techniques against classic BYOVD on daily.dev while hardening endpoints._ ### Why does the timing of the BTR.sys driver during Windows boot matter for security? BTR.sys can be configured as a Start=1 system driver in the Boot Bus Extender group, letting it run very early in boot Phase 1 when the filesystem is writable but security services haven't started yet. Check Point noted the primary antivirus service starts roughly 34 seconds after BTR.sys finishes, creating a 'Golden Window' where Defender binaries and registry keys can be deleted or modified before protection can launch. _Follow boot-sequence security findings like this on daily.dev to spot gaps before attackers do._ ## Similar posts on daily.dev - [BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive](https://daily.dev/posts/btr-reforged-weaponizing-defender-s-remediation-driver-as-a-kernel-operation-primitive-kmtmmxn82) · Check Point Research · 0 upvotes · 0 comments - [Microsoft Under Pressure to Bolster Defenses for BYOVD Attacks](https://daily.dev/posts/microsoft-under-pressure-to-bolster-defenses-for-byovd-attacks-98f7gahm1) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows) [View this post on daily.dev](https://daily.dev/posts/windows-defender-s-own-driver-can-leave-systems-defenseless-efii1uurv)