Verify Level Analysis has disclosed a way that makes use of Microsoft Defender’s personal legitimately signed boot-time remediation driver to carry out arbitrary kernel-level file and registry operations on Home windows programs starting from Home windows 7 by way of Home windows 11 25H2, with no software program flaw exploited and no driver imported from outdoors the machine.
The motive force, BTR.sys (Boot Time Removing Instrument), is a required Home windows part, which suggests it can’t be added to Microsoft’s Weak Driver Blocklist or blocked by way of Home windows Defender Software Management (WDAC) with out disrupting Defender itself.
Jiří Vinopal, a risk researcher and reverse engineer at Verify Level Analysis, introduced the findings as a main-stage briefing at Black Hat USA 2026 and DEF CON 34 in Las Vegas and printed the accompanying analysis paper alongside a proof-of-concept device, BTR_CLI, on August 20, 2026. Verify Level Analysis stated it discovered no proof the method has been utilized in real-world assaults.
“Throughout our evaluation throughout all collected samples and telemetry sources, we didn’t observe proof of real-world abuse of BTR.sys within the method demonstrated on this analysis. This implies the method is at present unknown or unused by risk actors, making proactive detection engineering possible earlier than weaponization seems within the wild,” Verify Level Analysis stated.
BTR.sys is embedded in Defender’s MpEngine.dll because the BOOTTIMETOOL useful resource and is deployed when Defender should end eradicating malware after a reboot, deleting recordsdata or registry entries that have been locked whereas Home windows was operating.
Vinopal reverse-engineered the motive force’s proprietary, undocumented transaction protocol and located that each configuration blob handed to BTR.sys is RC4-encrypted with a 256-byte key hard-coded within the .rdata part of each BTR.sys construct shipped since Home windows 7, verified unchanged throughout 18 distinctive 64-bit variations.
BTR_CLI, the proof-of-concept device, locates MpEngine.dll beneath Defender’s Definition Updates and extracts the embedded BTR.sys binary.
The device then constructs a sound encrypted transaction. It then installs the motive force as a service by way of direct HKLM registry writes utilizing Sort=1, Begin=1, and Group="Boot Bus Extender", a technique that bypasses the Service Management Supervisor fully and generates no Home windows Occasion ID 7045 (Service Put in) entry.
When loaded, BTR.sys executes the queued operations from Ring 0, attributed in telemetry to the System course of (PID 4), and might delete locked recordsdata and directories, transfer recordsdata to unconstrained paths together with System32drivers, delete registry keys and values, and write new registry values of any kind.
A second set off mode schedules these operations for the subsequent reboot.
The motive force then executes throughout what Vinopal calls the “golden window,” the interval after the filesystem turns into writable however earlier than Defender’s user-mode companies have began, permitting BTR.sys to bodily take away safety binaries resembling WdFilter.sys and MsMpEng.exe earlier than they will lock themselves.
A dwell demonstration at Black Hat confirmed BTR_CLI deleting your complete Defender stack from a completely up to date Home windows 11 25H2 machine with Tamper Safety lively.
Exploitation requires an administrator account with SeLoadDriverPrivilege, which BTR_CLI auto-enables for accounts that already maintain it.
In contrast to assaults that depend on the bring your own vulnerable driver method, which depend upon known-vulnerable third-party signed drivers that may be added to blocklists, the BTR Reforged method makes use of a driver constructed into each Home windows set up from Home windows 7 onward.
“The difficulty will not be a vulnerability within the conventional sense, however relatively an architectural belief boundary that may be crossed if an attacker already has administrative privileges. Following accountable disclosure, MSRC confirmed that these findings don’t meet the factors for speedy servicing, because the method depends on pre-existing administrative privileges (SeLoadDriverPrivilege),” Verify Level Analysis stated in the paper.
Vinopal’s GitHub repository for BTR_CLI provides that “No patch is deliberate,” a characterization Microsoft has not confirmed publicly.
BTR.sys was examined by safety researchers for a distinct flaw in the identical driver 5 years earlier.
In February 2021, SentinelLabs researcher Kasif Dekel disclosed CVE-2021-24092, a privilege escalation vulnerability that allowed a neighborhood non-administrator to overwrite arbitrary recordsdata by putting a tough hyperlink on the driver’s log path. Microsoft patched CVE-2021-24092 on February 9, 2021.
“We assume that this vulnerability remained undiscovered till now as a result of the motive force is generally not current on the onerous drive however relatively dropped and activated when wanted (with a random identify) after which purged away,” Kasif Dekel stated within the SentinelLabs disclosure.
Using a built-in Home windows driver as a kernel offensive primitive, relatively than a third-party weak one, was beforehand demonstrated within the context of FIN7’s AvNeutralizer, which weaponized the Home windows ProcLaunchMon.sys driver alongside the Course of Explorer driver to tamper with endpoint safety software program.
Verify Level Analysis stated the investigation that produced these findings had an uncommon origin.
“This analysis originated throughout an incident response investigation involving a compromised system, the place sure endpoint telemetry appeared suspicious however was in the end traced again to legit Home windows Defender remediation exercise,” Verify Level Analysis stated within the paper.
Verify Level Analysis has recognized the next Sysmon and Home windows occasion situations as indicators of potential BTR.sys abuse –
- Sysmon Occasion ID 15 (FileCreateStreamHash) the place the goal filename ends in
.sys:changelist, capturing the encrypted configuration Alternate Information Stream written to the motive force file - RegistryEvent (Sysmon Occasion ID 12 or 13) making a service key whose Args worth incorporates
:changelistand whose Group is “Boot Bus Extender,” particularly when unaccompanied by a Home windows Occasion ID 7045 (Service Put in) entry - Sysmon Occasion IDs 11 (FileCreate) and 23 (FileDelete) logging the speedy creation and deletion of
SystemRootTempBootClean.logby the System course of (PID 4), a log path hardcoded within the driver that fires whatever the caller - Sysmon Occasion ID 6 (DriverLoad) instantly adopted by Sysmon Occasion ID 23 (FileDelete) attributed to the System course of (PID 4), the kernel-mode execution fingerprint of a dwell BTR.sys set off
Verify Level Analysis additionally recommends proscribing the task of SeLoadDriverPrivilege as the first hardening management.
BTR_CLI is out there at github.com/Dump-GUY/BTR_CLI beneath the MIT license, with prebuilt x64 and x86 binaries connected to the repository’s releases.
The Hacker Information contacted Microsoft for touch upon its place concerning the BTR.sys method and Verify Level Analysis for extra technical element; neither had responded by publication.
