BTR.sys Abuse Allows Boot-Time Kernel Deletions of Defender Binaries on All Windows Releases

Check Point Research reverse-engineered BTR.sys from Defender's MpEngine.dll. The driver uses a hardcoded 256-byte RC4 key unchanged across 18 builds. BTR_CLI extracts it, crafts transactions, and registers the service directly in registry to run at boot without triggering Event ID 7045. This allows deletion of files like MsMpEng.exe before user-mode services start. Demonstration on Windows 11 25H2 with Tamper Protection succeeded.

The evidence trail shows every BTR.sys instance since Windows 7 contains the same key in .rdata. Operations execute as System process PID 4. No external driver needed, evading Vulnerable Driver Blocklist and WDAC. MSRC stated it does not meet servicing criteria due to reliance on SeLoadDriverPrivilege. No real-world samples found in telemetry.

This exposes an architectural trust issue where Defender's own remediation tool becomes an insider vector. Similar to other signed driver abuses but internal to Microsoft. Patterns suggest over-reliance on boot-time components without sufficient integrity checks post-admin compromise. Independent analysis confirms the protocol reverse-engineering but notes attribution remains to local admin rather than external threat.

Organizations should monitor for direct registry writes to HKLM\SYSTEM\CurrentControlSet\Services with Group="Boot Bus Extender". Future updates may require enhanced logging or key rotation in BTR.sys. Expect threat actors to integrate this into post-exploitation kits targeting enterprise endpoints within the next quarter.