Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Key Highlights

• Vinopal's GitHub repository for BTR_CLI adds that "No patch is planned," a characterization Microsoft has not confirmed publicly.
• "We assume that this vulnerability remained undiscovered until now because the driver is normally not present on the hard drive but rather dropped and activated when needed (with a random name) and then purged away," Kasif Dekel said in the SentinelLabs disclosure.
• "This research originated during an incident response investigation involving a compromised system, where certain endpoint telemetry appeared suspicious but was ultimately traced back to legitimate Windows Defender remediation activity," Check Point Research said in the paper.
• The driver then executes during what Vinopal calls the "golden window," the interval after the filesystem becomes writable but before Defender's user-mode services have started, allowing BTR.
• Check Point Research said it found no evidence the technique has been used in real-world attacks.

Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine.

The driver, BTR.

sys (Boot Time Removal Tool), is a required Windows component, which means it cannot be added to Microsoft's Vulnerable Driver Blocklist or blocked via Windows Defender Application Control (WDAC) without disrupting Defender itself.

Jiří Vinopal, a threat researcher and reverse engineer at Check Point Research, presented the findings as a main-stage briefing at Black Hat USA 2026 and DEF CON 34 in Las Vegas and published the accompanying research paper alongside a proof-of-concept tool, BTR_CLI, on August 20, 2026.

Check Point Research said it found no evidence the technique has been used in real-world attacks.

"During our analysis across all collected samples and telemetry sources, we did not observe evidence of real-world abuse of BTR.

sys in the manner demonstrated in this research.

This suggests the technique is currently unknown or unused by threat actors, making proactive detection engineering feasible before weaponization appears in the wild," Check Point Research said.

BTR.

sys is embedded in Defender's MpEngine.

dll as the BOOTTIMETOOL resource and is deployed when Defender must finish removing malware after a reboot, deleting files or registry entries that were locked while Windows was running.

Vinopal reverse-engineered the driver's proprietary, undocumented transaction protocol and found that every configuration blob passed to BTR.

sys is RC4-encrypted with a 256-byte key hard-coded in the .

rdata section of every BTR.

sys build shipped since Windows 7, verified unchanged across 18 unique 64-bit versions.

BTR_CLI, the proof-of-concept tool, locates MpEngine.

dll under Defender's Definition Updates and extracts the embedded BTR.

sys binary.

The tool then constructs a valid encrypted transaction.

It then installs the driver as a service via direct HKLM registry writes using Type=1, Start=1, and Group="Boot Bus Extender", a method that bypasses the Service Control Manager entirely and generates no Windows Event ID 7045 (Service Installed) entry.

When loaded, BTR.

A second trigger mode schedules those operations for the next reboot.

The driver then executes during what Vinopal calls the "golden window," the interval after the filesystem becomes writable but before Defender's user-mode services have started, allowing BTR.sys to physically remove security binaries such as WdFilter.sys and MsMpEng.exe before they can lock themselves.

A live demonstration at Black Hat showed BTR_CLI deleting the entire Defender stack from a fully updated Windows 11 25H2 machine with Tamper Protection active.

Exploitation requires an administrator account with SeLoadDriverPrivilege, which BTR_CLI auto-enables for accounts that already hold it.

Unlike attacks that rely on the bring your own vulnerable driver technique, which depend on known-vulnerable third-party signed drivers that can be added to blocklists, the BTR Reforged technique uses a driver built into every Windows installation from Windows 7 onward.

Originally reported by The Hacker News. TechVeb news desk.