Check Point Research has disclosed a technique that weaponizes Microsoft Defender’s own signed boot-time remediation driver, BTR.sys, to execute arbitrary kernel-level file and registry operations on fully patched Windows systems. Unlike traditional bring-your-own-vulnerable-driver attacks, this method relies on a trusted Windows component that cannot be blocklisted without breaking Defender itself.
What Happened: Check Point Researchers Weaponize Defender’s BTR.sys Driver
On August 20, 2026, Check Point Research published a paper detailing BTR Reforged, a technique that repurposes the Windows Defender Boot Time Removal driver as a universal kernel-operation primitive. The research was presented as a main-stage briefing at Black Hat USA 2026 and DEF CON 34 in Las Vegas.
The driver, known internally as BTR.sys, is embedded inside MpEngine.dll as the BOOTTIMETOOL resource. Microsoft drops it to disk with a randomized filename whenever Defender needs to delete files or registry entries that are locked while Windows is running. Check Point researcher Jiří Vinopal reverse-engineered the driver’s proprietary transaction protocol and discovered that every configuration blob passed to BTR.sys is encrypted with a hard-coded 256-byte RC4 key.
Furthermore, Vinopal found that this key has remained unchanged across 18 unique 64-bit builds shipped since Windows 7. Because the driver is legitimately signed and required for Defender to function, it cannot be added to Microsoft’s Vulnerable Driver Blocklist or blocked via Windows Defender Application Control.
Technical Details of the BTR Reforged Technique
The BTR.sys driver does not expose a standard IOCTL interface. Instead, it reads a configuration blob from an Alternate Data Stream attached to the driver file. The configuration specifies a list of transactions, each representing a kernel-level file or registry operation.
Supported actions include:
- Delete File — Removes locked files that user-mode processes cannot touch
- Delete Directory — Empties and removes directories from Ring 0
- Move / Quarantine — Moves files to arbitrary paths, including System32\drivers
- Delete Registry Key — Removes keys and subkeys without user-mode restrictions
- Delete Registry Value — Clears specific values under a key
- Set Registry Value — Writes arbitrary registry data for persistence or disabling security controls
The driver executes during what Vinopal calls the golden window. This is the interval after the filesystem becomes writable but before Defender’s user-mode services have started. Consequently, BTR.sys can physically remove security binaries such as WdFilter.sys and MsMpEng.exe before they can lock themselves.
A live demonstration at Black Hat showed BTR_CLI, the proof-of-concept tool, deleting the entire Defender stack from a fully updated Windows 11 25H2 machine with Tamper Protection active. Check Point Research stated it found no evidence the technique has been used in real-world attacks.
Business and Operational Impact
The implications for enterprise security are significant. Traditional endpoint protection strategies rely on driver blocklists and application control policies to stop BYOVD attacks. However, BTR.sys is a built-in component that cannot be blocked without disabling Defender itself.
Key impacts include:
- EDR/AV bypass — Attackers can delete or cripple security software before it loads
- No external driver required — The technique uses only components already present on the system
- Stealthy execution — Operations run as the System process and leave minimal telemetry
- Broad Windows coverage — Affects Windows 7 through Windows 11 25H2
Organizations that rely on Tamper Protection as a last line of defense should note that this control does not prevent BTR.sys from executing during the boot golden window.
Mitigation and Recommendations
Check Point Research recommends restricting SeLoadDriverPrivilege as the primary hardening control. This privilege is required to install the driver as a service.
Immediate Actions for Defenders
- Audit accounts that hold SeLoadDriverPrivilege and remove it where unnecessary
- Deploy Sysmon rules to detect .sys:changelist Alternate Data Stream creation
- Monitor for registry service keys with Group “Boot Bus Extender” and no matching Event ID 7045
- Alert on System process creating or deleting BootClean.log in \SystemRoot\Temp
- Review driver loads followed immediately by file deletions attributed to PID 4
Detection Engineering Priorities
Security teams should tune their detection stacks for the following telemetry patterns:
- Sysmon Event ID 15 where the target filename ends in .sys:changelist
- Registry events creating a service key whose Args value contains :changelist
- Sysmon Event IDs 11 and 23 for rapid BootClean.log creation and deletion
- Sysmon Event ID 6 followed by Event ID 23 under the System process
Bottom line: The BTR Reforged technique demonstrates that trusted defensive components can become offensive primitives. Enterprises should harden privileged accounts and invest in boot-time telemetry to catch abuse before security software is disabled.
Incident Summary
| CVE ID / Incident: | BTR Reforged — Weaponizing Defender’s Remediation Driver (disclosed August 20, 2026) |
| Affected Systems: | Windows 7, Windows 10, Windows 11, Windows Server (all versions shipping BTR.sys) |
| Disclosure Date: | August 20, 2026 |
| Patch Status: | No patch planned — Microsoft confirmed findings do not meet servicing criteria |
| Exploitation Requirements: | Administrative privileges with SeLoadDriverPrivilege |
| Real-World Abuse: | None observed as of disclosure |
References
- Check Point Research, “BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive,” August 20, 2026, https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/, accessed August 23, 2026.
- The Hacker News, “Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot,” August 20, 2026, https://thehackernews.com/2026/08/microsoft-defenders-own-driver-can-be.html, accessed August 23, 2026.
- SentinelLabs, “CVE-2021-24092: 12 Years in Hiding — A Privilege Escalation Vulnerability in Windows Defender,” February 2021, https://www.sentinelone.com/labs/cve-2021-24092-12-years-in-hiding-a-privilege-escalation-vulnerability-in-windows-defender/, accessed August 23, 2026.
- Vinopal, Jiří, “BTR_CLI” GitHub repository, MIT License, https://github.com/Dump-GUY/BTR_CLI, accessed August 23, 2026.
