Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software

Introduction

Security researchers at Check Point Research have discovered a alarming technique that uses Microsoft Defender's own legitimate driver to delete security software and disable endpoint protection on Windows systems.

The driver, called BTR.sys (Boot Time Removal Tool), is a required Windows component that cannot be blocked or added to Microsoft's Vulnerable Driver Blocklist without breaking Defender itself. This makes it a powerful tool for attackers who have already gained administrator privileges.

What Is BTR.sys?

BTR.sys (Boot Time Removal Tool) is a legitimate Windows driver embedded in Microsoft Defender's MpEngine.dll. It is used by Defender to remove malware that cannot be deleted while Windows is running.

Key facts about BTR.sys:

• It is a required Windows component — it cannot be removed or blocked
• It has been present in every Windows version from Windows 7 through Windows 11 25H2
• It runs at kernel level (Ring 0) — the highest privilege level
• It can delete locked files, move files, and modify registry entries
• It executes during boot, before most security software starts

The driver is normally not present on the hard drive. Instead, it is dropped and activated when needed, then purged away. This makes it harder to detect and analyze.

How the Attack Works

Security researcher Jiří Vinopal reverse-engineered the driver and discovered that every configuration blob passed to BTR.sys is RC4-encrypted with a hard-coded 256-byte key that has been unchanged since Windows 7.

The attack process:

• Step 1: The attacker gains administrator privileges on the target machine (SeLoadDriverPrivilege)
• Step 2: They extract the embedded BTR.sys binary from Defender's MpEngine.dll
• Step 3: They construct a valid encrypted transaction using the hard-coded RC4 key
• Step 4: They install the driver as a service via direct registry writes — bypassing the Service Control Manager and generating no Windows Event ID 7045 (Service Installed) entry
• Step 5: When loaded, BTR.sys executes the queued operations from Ring 0 (kernel level)
• Step 6: The driver executes during the "golden window" — after the filesystem becomes writable but before Defender's user-mode services have started
• Step 7: BTR.sys physically removes security binaries such as WdFilter.sys and MsMpEng.exe

A live demonstration at Black Hat USA 2026 showed BTR_CLI deleting the entire Defender stack from a fully updated Windows 11 25H2 machine with Tamper Protection active.

Why This Is Dangerous

This technique is particularly concerning for several reasons:

• No vulnerability required: This is not a software bug — it's a feature being abused
• Cannot be blocked: BTR.sys is a required Windows component — adding it to the Vulnerable Driver Blocklist would break Defender
• Works on all Windows versions: From Windows 7 through Windows 11 25H2
• Bypasses Tamper Protection: The demonstration showed it working even with Tamper Protection enabled
• No logs generated: The attack bypasses the Service Control Manager and generates no service installation logs
• Attributed to System process: Telemetry shows the driver executing as the System process (PID 4), making it look like legitimate activity

How to Detect This Attack

Check Point Research has identified several indicators that can help detect BTR.sys abuse:

• Sysmon Event ID 15: File creation where the target filename ends in .sys:changelist
• Registry Events (Sysmon ID 12 or 13): Creating a service key with Args value containing :changelist and Group="Boot Bus Extender"
• Sysmon Event IDs 11 and 23: Rapid creation and deletion of \SystemRoot\Temp\BootClean.log by the System process
• Sysmon Event ID 6 followed by Event ID 23: Driver load immediately followed by file deletion attributed to the System process
• No Windows Event ID 7045: Service installed event is missing

How to Protect Your Business

Follow these steps to protect your systems:

• Restrict SeLoadDriverPrivilege: This is the primary hardening control. Only administrators should have this privilege, and it should be tightly controlled.
• Monitor for the indicators above: Implement logging and alerting for the Sysmon events that indicate BTR.sys abuse.
• Use least privilege: Limit administrative access to only those who absolutely need it.
• Enable advanced logging: Use Sysmon to capture detailed file, registry, and driver events.
• Implement endpoint detection and response (EDR): EDR solutions can detect unusual driver loading patterns.
• Regularly review administrative accounts: Ensure that only authorized users have administrator privileges.
• Use application whitelisting: Restrict which drivers can be loaded.
• Monitor for unusual driver loads: Any driver load event should be investigated.

Important note: Microsoft has stated that this technique "does not meet the criteria for immediate servicing" because it requires pre-existing administrative privileges. According to Check Point Research, "No patch is planned."

Final Thoughts

The BTR.sys technique demonstrates a fundamental challenge in cybersecurity: legitimate tools can be weaponized by attackers who have already gained administrative access.

Key takeaways:

• Microsoft Defender's BTR.sys driver can be weaponized to delete security software
• It works on all Windows versions from Windows 7 through Windows 11 25H2
• The driver cannot be blocked without disrupting Defender itself
• The attack requires administrator privileges but bypasses Tamper Protection
• No patch is planned — this is an architectural feature being abused
• Restricting SeLoadDriverPrivilege is the primary defense

If you need help securing your Windows environment or want to learn more about protecting your business from these threats, contact SystemLogicIT for a free security assessment.