Microsoft Defender BTR.sys Driver Can Be Abused to Kill Security at Boot

Check Point Research has disclosed a technique that weaponizes Microsoft Defender's own legitimately signed boot-time remediation driver, BTR.sys, to perform arbitrary kernel-level file and registry operations on Windows systems, without exploiting any software flaw and without importing any external driver. The attack surface spans Windows 7 through Windows 11 25H2, and because BTR.sys is a required Windows component, it cannot be added to Microsoft's Vulnerable Driver Blocklist or blocked via Windows Defender Application Control (WDAC) without breaking Defender itself.

Researcher Jiří Vinopal presented the findings as a main-stage briefing at Black Point USA 2026 and DEF CON 34, publishing an accompanying research paper and a proof-of-concept tool called BTR_CLI on August 20, 2026. Check Point said it found no evidence of real-world abuse, noting that proactive detection engineering is feasible before the technique appears in the wild. BTR.sys is embedded inside Defender's MpEngine.dll as the BOOTTIMETOOL resource and is deployed when Defender must finish removing malware after a reboot. Vinopal reverse-engineered its undocumented transaction protocol and discovered that every configuration blob is RC4-encrypted with a 256-byte key hard-coded in the .rdata section of every BTR.sys build shipped since Windows 7, verified unchanged across 18 unique 64-bit versions.

BTR_CLI extracts the embedded BTR.sys binary from MpEngine.dll, constructs a valid encrypted transaction, and installs the driver as a service via direct HKLM registry writes using Type=1, Start=1, and Group="Boot Bus Extender", bypassing the Service Control Manager entirely so that no Windows Event ID 7045 entry is generated. Once loaded, BTR.sys executes queued operations from Ring 0 under the System process (PID 4), enabling attackers to delete locked files and directories, move files into unconstrained paths including System32\drivers, delete registry keys and values, and write new registry values of any type. A second trigger mode queues those operations for the next reboot, executing during what Vinopal calls the "golden window," the interval after the filesystem becomes writable but before Defender's user-mode services have started, allowing BTR.sys to physically remove security software. Defenders should audit their environments for unauthorized service entries and anomalous registry modifications using tools like our port scanner and WHOIS lookup to validate external infrastructure, while teams concerned about credential exposure can run an email breach checker to identify compromised accounts that could facilitate initial access for such post-exploitation chains.