Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point Research disclosed a technique weaponizing Microsoft Defender's own BTR.sys (Boot Time Removal Tool) driver to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2, without exploiting any software flaw The driver is a built-in, legitimately signed Windows component that cannot be blocklisted or blocked via WDAC without disabling Defender itself, making traditional defensive mitigations ineffective The proof-of-concept tool BTR_CLI demonstra
Analysis
TL;DR
- Check Point Research disclosed a technique weaponizing Microsoft Defender's own BTR.sys (Boot Time Removal Tool) driver to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2, without exploiting any software flaw
- The driver is a built-in, legitimately signed Windows component that cannot be blocklisted or blocked via WDAC without disabling Defender itself, making traditional defensive mitigations ineffective
- The proof-of-concept tool BTR_CLI demonstrates deleting the entire Defender stack including Tamper Protection from a fully updated Windows 11 25H2 machine by exploiting a "golden window" between filesystem writability and Defender service startup
- The technique relies on a hard-coded RC4 encryption key and an undocumented transaction protocol reverse-engineered from the driver, with no evidence of real-world abuse detected so far
- Microsoft confirmed the findings do not meet criteria for immediate servicing as exploitation requires pre-existing administrative privileges with SeLoadDriverPrivilege, and no patch is planned
Why It Matters
This research exposes a fundamental architectural trust boundary in Windows: a security product's own remediation driver can be repurposed as a kernel-level offensive primitive, effectively allowing an attacker to disable the very protection mechanism designed to defend the system. For AI and security practitioners, it underscores that defensive tooling can become an attack surface when it operates with unrestricted kernel privileges, and that traditional mitigation strategies like driver blocklisting are insufficient against built-in Windows components.
Technical Details
- BTR.sys Architecture: The Boot Time Removal Tool driver is embedded within Defender's MpEngine.dll as the BOOTTIMETOOL resource and is deployed when Defender must complete malware removal after a reboot, targeting files or registry entries locked during normal Windows operation
- Reverse-Engineered Protocol: Jiří Vinopal discovered a proprietary, undocumented transaction protocol where every configuration blob passed to BTR.sys is RC4-encrypted using a 256-byte key hard-coded in the .rdata section, verified unchanged across 18 unique 64-bit driver versions spanning Windows 7 onward
- Stealthy Installation Method: BTR_CLI installs the driver as a service via direct HKLM registry writes (Type=1, Start=1, Group="Boot Bus Extender"), completely bypassing the Service Control Manager and generating no Windows Event ID 7045 (Service Installed) entry
- Golden Window Exploitation: The driver executes queued operations from Ring 0 during the interval after the filesystem becomes writable but before Defender's user-mode services start, enabling physical removal of security binaries like WdFilter.sys and MsMpEng.exe before they can self-lock
- Capabilities: Once loaded, BTR.sys can delete locked files and directories, move files to unconstrained paths including System32\drivers, delete registry keys and values, and write new registry values of any type, all attributed in telemetry to the System process (PID 4)
- Detection Indicators: Check Point identified Sysmon Event ID 15 (FileCreateStreamHash) targeting filenames ending in .sys:changelist to capture the encrypted configuration Alternate Data Stream, along with RegistryEvent (Sysmon Event ID 12 or 13) for service key creation
Industry Insight
- Security vendors and enterprise defenders should reassess the trust placed in built-in OS drivers that operate with unrestricted kernel privileges; the assumption that legitimate signed drivers are inherently safe is flawed when they can be invoked by any process holding administrative privileges
- The "no patch planned" stance from Microsoft highlights a growing category of architectural issues that fall outside traditional vulnerability management frameworks, requiring organizations to implement proactive detection engineering and behavioral monitoring rather than relying on vendor remediation
- This technique represents an evolution of the "bring your own vulnerable driver" attack pattern into "bring your own legitimate driver" territory, suggesting that future defensive strategies must account for weaponization of core OS components and consider runtime integrity monitoring, driver load restrictions, and segmentation of boot-time privilege boundaries
Disclaimer: The above content is generated by AI and is for reference only.