BTR Reforged: Microsoft Defender’s Driver Can Be Weaponized Against Windows Security

A Legitimate Function Used to Disable Defenses

An internal Microsoft Defender component can be abused by an attacker who already has administrator access to delete files, modify the registry, and remove security software during Windows startup.

The technique, dubbed BTR Reforged, was presented by Jiří Vinopal of Check Point Research at Black Hat USA 2026 and DEF CON 34 in Las Vegas. The technical paper and proof of concept were published on August 20, 2026. The news emerged on August 21, 2026.

So far, Check Point Research has found no evidence that the technique has been used in real-world attacks across the samples and telemetry it analyzed. The risk is nevertheless tangible: the demonstration code makes it possible to reproduce the abuse of a signed Microsoft driver that is normally present on Windows systems.

The component involved is BTR.sys, short for Boot Time Removal Tool. Defender uses it to complete the removal of malware or files that could not be deleted while the system was running, after a reboot.

BTR.sys is embedded in Defender’s MpEngine.dll library as a resource named BOOTTIMETOOL. It is therefore neither an external driver downloaded by the attacker nor an unknown component installed separately.

The technique affects systems from Windows 7 through Windows 11 25H2.

What BTR.sys Can Do at Kernel Level

The researcher reverse-engineered the proprietary protocol used to send instructions to the driver. Configuration blocks intended for BTR.sys are encrypted with RC4, using a static 256-byte key stored in the driver’s .rdata section.

The same key was found in 18 unique 64-bit versions of BTR.sys distributed since Windows 7. This allows the proof of concept to extract the driver from the current Defender copy and prepare an apparently valid transaction.

The public BTR_CLI tool searches for MpEngine.dll in Defender’s definition-update directory, extracts BTR.sys, and configures the driver to load through direct writes to the HKLM registry hive.

The service key is configured with:

• Type=1;
• Start=1;
• Group="Boot Bus Extender".

The procedure does not go through the Service Control Manager. As a result, it does not generate the standard Windows Event ID 7045, which is associated with the installation of a new service. This can reduce the visibility of controls that rely exclusively on that event.

Once loaded, the operations run in Ring 0, Windows’ privileged kernel level. Telemetry may therefore attribute them to the System process, with PID 4, rather than to the program that prepared the operation.

Observed capabilities include:

• deleting locked files and directories;
• moving files to normally protected locations, including System32\drivers;
• deleting registry keys and values;
• creating or modifying registry values of any type.

BTR.sys can also schedule operations for the next reboot. This is the most useful mode for acting before user-mode security services are fully operational.

The Startup Window and Defender Removal

The technique exploits an operational window between the filesystem becoming writable and Microsoft Defender’s user-mode services starting.

During this window, BTR.sys can physically remove components that, once active, would attempt to protect their own files or block the changes. In its demonstration, Check Point Research removed the entire Defender stack from a fully updated Windows 11 25H2 machine, even though Tamper Protection was enabled.

Potential targets include WdFilter.sys, Defender’s filter driver, and MsMpEng.exe, the main antimalware engine process.

The prerequisite is critical. The attacker must already control an administrator account with SeLoadDriverPrivilege, the right required to load drivers. BTR_CLI can enable the privilege only for accounts that already possess it; it does not escalate a standard user’s privileges.

For this reason, Microsoft does not consider the issue a conventional vulnerability requiring an immediate fix. MSRC’s assessment places it closer to a breach of an architectural trust boundary: anyone who already controls an administrator account has capabilities sufficient to deeply compromise the system.

The BTR_CLI repository states that a corrective update is not expected. Microsoft, however, has not publicly confirmed this position.

Why the Blocklist and WDAC Are Not Enough

BTR Reforged differs from the Bring Your Own Vulnerable Driver model, in which an attacker introduces a signed third-party driver and exploits a known vulnerability to operate in the kernel.

In that scenario, the driver can be added to the Microsoft Vulnerable Driver Blocklist or restricted with Windows Defender Application Control (WDAC). BTR.sys, by contrast, is an integrated Microsoft component required for Defender’s remediation operations.

Blocking it indiscriminately could prevent the product from completing threat removal during a reboot. Its presence in Windows therefore makes it difficult to apply the countermeasures normally used against vulnerable drivers without disrupting a legitimate system function.

There is also a specific precedent. In February 2021, SentinelLabs’ Kasif Dekel described CVE-2021-24092, a privilege-escalation vulnerability in BTR.sys. A non-administrative local user could overwrite arbitrary files by placing a hard link in the driver’s log path.

Microsoft fixed CVE-2021-24092 on February 9, 2021. The flaw had a CVSS score of 7.8, with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

BTR.sys could remain unnoticed because it is not normally present on disk: it is extracted and activated only when needed under a random name, then removed. The offensive use of integrated drivers to interfere with endpoint security is not unprecedented, however: the FIN7 group had already combined Windows drivers with Process Explorer components in the AvNeutralizer tool.

Over the past 90 days, CISA’s KEV catalog has also included six vulnerabilities affecting Microsoft products: CVE-2026-55040 and CVE-2026-33824 on August 18, 2026, CVE-2026-68820 on August 11, 2026, CVE-2026-50522 on July 22, 2026, CVE-2026-58644 on July 16, 2026, and CVE-2026-45659 on July 1, 2026. The latter is marked as exploited in ransomware campaigns.

BTR Reforged is not a CVE entry and is not listed in the KEV catalog. There is therefore no CISA mitigation deadline associated with this technique.

Detection and Mitigations for IT Teams

The first practical measure is to strictly limit the assignment of SeLoadDriverPrivilege. The privilege should be granted only to accounts and services with a documented need, with particular attention to local administrators and remote-management tools.

Security teams can look for several anomalous sequences in Sysmon and Windows logs:

• Sysmon Event ID 15 – FileCreateStreamHash on a file whose name ends in .sys:changelist, potentially an Alternate Data Stream containing the encrypted configuration;
• Sysmon Event ID 12 or 13 – RegistryEvent indicating the creation of a service key with Args containing :changelist and Group set to Boot Bus Extender;
• the absence of Windows Event ID 7045 in connection with the key’s creation;
• Sysmon Event ID 11 followed by Event ID 23, indicating the rapid creation and deletion of \SystemRoot\Temp\BootClean.log;
• a load detected with Sysmon Event ID 6, immediately followed by deletion of the file with Event ID 23, with both events attributed to System/PID 4.

BootClean.log is a path embedded in the driver and may also appear during legitimate activity. On its own, it does not prove an attack; it becomes more significant when it coincides with service-key creation, the absence of Event ID 7045, and anomalous changes to Defender components.

The BTR_CLI proof of concept is available on GitHub under an MIT license and includes x64 and x86 binaries. Organizations can use it in isolated environments to validate detection and response rules, but should avoid running it on production systems.