Check Point Details Boot-Time Abuse Path in Microsoft Defender Driver
Check Point Research has demonstrated a technique that repurposes Microsoft Defender’s signed Boot Time Removal Tool driver, BTR.sys, to perform kernel-level file and registry operations during Windows startup. The researchers said the method affects systems from Windows 7 through Windows 11 25H2 and requires an administrator account with SeLoadDriverPrivilege.
BTR.sys is a legitimate Defender component used when malware removal must continue after a reboot. In a Black Hat USA 2026 demonstration, researcher Jiří Vinopal used the proof-of-concept utility BTR_CLI to remove the Defender stack from a fully updated Windows 11 25H2 system with Tamper Protection enabled.
A legitimate remediation driver becomes a boot-time primitive
The driver is embedded in Defender’s MpEngine.dll as a BOOTTIMETOOL resource and is deployed to remove files or registry entries that are locked while Windows is running. Check Point found that BTR.sys accepts a proprietary transaction format whose configuration blobs are RC4-encrypted using a 256-byte key hard-coded in the driver’s .rdata section.
Vinopal verified that the key was unchanged across 18 unique 64-bit BTR.sys versions shipped since Windows 7. BTR_CLI extracts the driver from Defender definition updates, constructs an encrypted transaction, and installs it through direct HKLM registry writes. The service configuration uses Type=1, Start=1 and the group name Boot Bus Extender, bypassing the Service Control Manager and avoiding a Windows Event ID 7045 service-installation record.
Once loaded, the driver executes queued actions from Ring 0 under the System process, PID 4. Those actions can delete locked files and directories, move files to paths including System32\drivers, delete registry keys and values, and write registry values. A second mode schedules operations for the following reboot.
The window before Defender services start
Check Point calls the interval after the file system becomes writable but before Defender user-mode services start the “golden window.” In that period, BTR.sys can remove security binaries, including WdFilter.sys and MsMpEng.exe, before they lock themselves. The technique differs from bring-your-own-vulnerable-driver attacks because it relies on a Windows component already present on the machine rather than an imported, known-vulnerable third-party driver.
Microsoft’s Security Response Center determined that the findings did not meet the criteria for immediate servicing because the technique depends on pre-existing administrative privileges. Check Point said it found no evidence that attackers have used BTR.sys in this manner. The driver cannot simply be added to Microsoft’s Vulnerable Driver Blocklist or blocked through Windows Defender Application Control without disrupting Defender’s own remediation function.
Detection and hardening priorities
Check Point identified several telemetry signals for defenders: Sysmon Event ID 15 for a target ending in .sys:changelist; Sysmon RegistryEvent IDs 12 or 13 for a service whose Args value contains :changelist and whose Group is Boot Bus Extender; and rapid creation and deletion of \SystemRoot\Temp\BootClean.log by PID 4. A Sysmon DriverLoad event immediately followed by a System-process FileDelete event is another execution fingerprint.
The research adds a boot-time persistence and defense-evasion angle to the wider operational risks around security tooling and attack chains described in security tooling and attack chains, where telemetry correlation and privileged-access control remain essential. For businesses, the direct action is to restrict assignment of SeLoadDriverPrivilege and tune monitoring for the specified driver, registry and boot-time file events.