Verify Level Analysis has disclosed a method that makes use of Microsoft Defender’s personal legitimately signed boot-time remediation driver to carry out arbitrary kernel-level file and registry operations on Home windows techniques starting from Home windows 7 via Home windows 11 25H2, with no software program flaw exploited and no driver imported from exterior the machine.
The driving force, BTR.sys (Boot Time Removing Software), is a required Home windows element, which suggests it can’t be added to Microsoft’s Susceptible Driver Blocklist or blocked by way of Home windows Defender Utility Management (WDAC) with out disrupting Defender itself.
Jiří Vinopal, a risk researcher and reverse engineer at Verify Level Analysis, offered the findings as a main-stage briefing at Black Hat USA 2026 and DEF CON 34 in Las Vegas and revealed the accompanying analysis paper alongside a proof-of-concept device, BTR_CLI, on August 20, 2026. Verify Level Analysis stated it discovered no proof the method has been utilized in real-world assaults.
“Throughout our evaluation throughout all collected samples and telemetry sources, we didn’t observe proof of real-world abuse of BTR.sys within the method demonstrated on this analysis. This implies the method is presently unknown or unused by risk actors, making proactive detection engineering possible earlier than weaponization seems within the wild,” Verify Level Analysis stated.
BTR.sys is embedded in Defender’s MpEngine.dll because the BOOTTIMETOOL useful resource and is deployed when Defender should end eradicating malware after a reboot, deleting information or registry entries that have been locked whereas Home windows was operating.
Vinopal reverse-engineered the driving force’s proprietary, undocumented transaction protocol and located that each configuration blob handed to BTR.sys is RC4-encrypted with a 256-byte key hard-coded within the .rdata part of each BTR.sys construct shipped since Home windows 7, verified unchanged throughout 18 distinctive 64-bit variations.
BTR_CLI, the proof-of-concept device, locates MpEngine.dll beneath Defender’s Definition Updates and extracts the embedded BTR.sys binary.
The device then constructs a legitimate encrypted transaction. It then installs the driving force as a service by way of direct HKLM registry writes utilizing Sort=1, Begin=1, and Group="Boot Bus Extender", a technique that bypasses the Service Management Supervisor totally and generates no Home windows Occasion ID 7045 (Service Put in) entry.
When loaded, BTR.sys executes the queued operations from Ring 0, attributed in telemetry to the System course of (PID 4), and may delete locked information and directories, transfer information to unconstrained paths together with System32drivers, delete registry keys and values, and write new registry values of any sort.
A second set off mode schedules these operations for the subsequent reboot.
The driving force then executes throughout what Vinopal calls the “golden window,” the interval after the filesystem turns into writable however earlier than Defender’s user-mode providers have began, permitting BTR.sys to bodily take away safety binaries reminiscent of WdFilter.sys and MsMpEng.exe earlier than they will lock themselves.
A reside demonstration at Black Hat confirmed BTR_CLI deleting the whole Defender stack from a completely up to date Home windows 11 25H2 machine with Tamper Safety lively.
Exploitation requires an administrator account with SeLoadDriverPrivilege, which BTR_CLI auto-enables for accounts that already maintain it.
In contrast to assaults that depend on the deliver your individual weak driver method, which rely on known-vulnerable third-party signed drivers that may be added to blocklists, the BTR Reforged method makes use of a driver constructed into each Home windows set up from Home windows 7 onward.
“The problem shouldn’t be a vulnerability within the conventional sense, however moderately an architectural belief boundary that may be crossed if an attacker already has administrative privileges. Following accountable disclosure, MSRC confirmed that these findings don’t meet the standards for fast servicing, because the method depends on pre-existing administrative privileges (SeLoadDriverPrivilege),” Verify Level Analysis stated in the paper.
Vinopal’s GitHub repository for BTR_CLI provides that “No patch is deliberate,” a characterization Microsoft has not confirmed publicly.
BTR.sys was examined by safety researchers for a unique flaw in the identical driver 5 years earlier.
In February 2021, SentinelLabs researcher Kasif Dekel disclosed CVE-2021-24092, a privilege escalation vulnerability that allowed an area non-administrator to overwrite arbitrary information by inserting a tough hyperlink on the driver’s log path. Microsoft patched CVE-2021-24092 on February 9, 2021.
“We assume that this vulnerability remained undiscovered till now as a result of the driving force is generally not current on the laborious drive however moderately dropped and activated when wanted (with a random identify) after which purged away,” Kasif Dekel stated within the SentinelLabs disclosure.
The usage of a built-in Home windows driver as a kernel offensive primitive, moderately than a third-party weak one, was beforehand demonstrated within the context of FIN7’s AvNeutralizer, which weaponized the Home windows ProcLaunchMon.sys driver alongside the Course of Explorer driver to tamper with endpoint safety software program.
Verify Level Analysis stated the investigation that produced these findings had an uncommon origin.
“This analysis originated throughout an incident response investigation involving a compromised system, the place sure endpoint telemetry appeared suspicious however was finally traced again to official Home windows Defender remediation exercise,” Verify Level Analysis stated within the paper.
Verify Level Analysis has recognized the next Sysmon and Home windows occasion situations as indicators of potential BTR.sys abuse –
- Sysmon Occasion ID 15 (FileCreateStreamHash) the place the goal filename ends in
.sys:changelist, capturing the encrypted configuration Alternate Information Stream written to the driving force file - RegistryEvent (Sysmon Occasion ID 12 or 13) making a service key whose Args worth incorporates
:changelistand whose Group is “Boot Bus Extender,” particularly when unaccompanied by a Home windows Occasion ID 7045 (Service Put in) entry - Sysmon Occasion IDs 11 (FileCreate) and 23 (FileDelete) logging the speedy creation and deletion of
SystemRootTempBootClean.logby the System course of (PID 4), a log path hardcoded within the driver that fires whatever the caller - Sysmon Occasion ID 6 (DriverLoad) instantly adopted by Sysmon Occasion ID 23 (FileDelete) attributed to the System course of (PID 4), the kernel-mode execution fingerprint of a reside BTR.sys set off
Verify Level Analysis additionally recommends proscribing the project of SeLoadDriverPrivilege as the first hardening management.
BTR_CLI is offered at github.com/Dump-GUY/BTR_CLI beneath the MIT license, with prebuilt x64 and x86 binaries connected to the repository’s releases.
The Hacker Information contacted Microsoft for touch upon its place relating to the BTR.sys method and Verify Level Analysis for added technical element; neither had responded by publication.
