Summary Points
- Attackers can exploit the built-in Windows driver BTR.sys to perform kernel-level file and registry operations post-reboot, bypassing traditional security controls without requiring driver vulnerabilities.
- The technique leverages legitimate, signed Windows components, making detection difficult and enabling stealthy removal of security binaries like Windows Defender during the "golden window" between file system writeability and security service startup.
- Successful exploitation requires administrative privileges with SeLoadDriverPrivilege, presenting a significant risk if compromised accounts are present, and existing indicators include suspicious driver load and file activity logs.
Threat Overview, Techniques, and Targets
Check Point Research revealed that Microsoft Defender’s own driver, BTR.sys, can be weaponized for malicious purposes. This driver is part of Windows and is used to remove malware during startup. Threat actors can exploit BTR.sys without exploiting any software flaw or importing outside drivers. They do this by using a proof-of-concept tool called BTR_CLI, which locates and extracts BTR.sys from Defender files. The attacker then encrypts instructions and installs BTR.sys as a service by writing directly to the registry. This bypasses Windows Event logging. Once active, BTR.sys can delete files, move files to protected locations, remove registry keys, and even delete security software components during a “golden window” after the filesystem becomes writable but before Defender’s user mode services load. The attack requires administrator privileges with SeLoadDriverPrivilege. The technique affects Windows versions from Windows 7 to Windows 11 25H2.
Impact, Security Implications, and Remediation Guidance
This technique allows an attacker with administrator access to disable Windows security features by deleting security binaries and files before they start. This can disable Windows Defender, leaving the system vulnerable. The method does not rely on known vulnerabilities, but on trusting built-in Windows components. It presents a significant security risk if an attacker already has admin privileges. Detection may include monitoring for specific Sysmon event IDs linked to suspicious driver creation, file deletions, or registry modifications. Restricting the assignment of SeLoadDriverPrivilege can help reduce risk. If you suspect or want to prevent such activity, consult Microsoft or trusted cybersecurity sources for detailed mitigation strategies. The BTR_CLI tool is publicly available on GitHub without patches planned, but official guidance should be obtained from Microsoft or cybersecurity authorities.
Expand Your Tech Knowledge
Explore the future of technology with our detailed insights on Artificial Intelligence.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
