Microsoft Defender's Own Driver Used to Delete Security Software at Boot Time

Researchers at Check Point Research have discovered a technique that allows an attacker to use Microsoft Defender's own driver, BTR.sys, to delete security software at boot time. This technique, dubbed 'BTR Reforged,' uses a legitimate Windows component to perform arbitrary kernel-level file and registry operations on Windows systems from Windows 7 through Windows 11 25H2.

The researchers found that the BTR.sys driver is embedded in Defender's MpEngine.dll as the BOOTTIMETOOL resource and is deployed when Defender must finish removing malware after a reboot. They also discovered that every configuration blob passed to BTR.sys is RC4-encrypted with a 256-byte key hard-coded in the .rdata section of every BTR.sys build shipped since Windows 7.

To exploit this technique, an attacker would need an administrator account with SeLoadDriverPrivilege. The researchers demonstrated that this can be achieved using their proof-of-concept tool, BTR_CLI, which locates MpEngine.dll under Defender's Definition Updates and extracts the embedded BTR.sys binary. They also showed how to construct a valid encrypted transaction and install the driver as a service via direct HKLM registry writes.