Ethical Hacking News
A recently discovered vulnerability in Microsoft Defender's BTR.sys driver allows threat actors to delete security software at boot time, rendering Windows users vulnerable to various threats. Check Point Research has identified the vulnerability and provided recommendations for users to take to protect themselves.
Microsoft Defender, a component of the Windows Security suite, has a vulnerability that can be exploited to delete security software at boot time. The BTR.sys driver, a required Windows component, can be used to delete security software and render users vulnerable to threats. Check Point Research discovered the vulnerability and found that it allows attackers to perform arbitrary kernel-level file and registry operations. The driver's encryption method makes it challenging for threat actors to exploit the vulnerability without administrative privileges. To exploit the vulnerability, attackers need to obtain the SeLoadDriverPrivilege, which is required for the BTR.sys driver to function. A proof-of-concept tool, BTR_CLI, was developed to demonstrate the vulnerability and its potential for malicious use. Microsoft has not confirmed a patch for the vulnerability, stating it does not meet the criteria for immediate servicing. The discovery highlights the importance of continuous monitoring and vigilance in the cybersecurity landscape.
Microsoft Defender, a vital component of the Windows Security suite, has been found to be vulnerable to exploitation by threat actors. According to Check Point Research, a renowned cybersecurity firm, the BTR.sys driver, a part of Microsoft Defender, can be weaponized to delete security software at boot time. This discovery has significant implications for Windows users, as it highlights a potential vulnerability in the very driver designed to protect them.
The BTR.sys driver, also known as the Boot Time Removal Tool, is a required Windows component that plays a crucial role in the remediation process. It is deployed when Microsoft Defender needs to finish removing malware after a reboot, deleting files or registry entries that were locked while Windows was running. However, in the wrong hands, this driver can be used to delete security software altogether, rendering Windows users vulnerable to various threats.
Check Point Research, led by threat researcher and reverse engineer Jiří Vinopal, discovered this vulnerability through an incident response investigation involving a compromised system. The research team found that the BTR.sys driver could be used to perform arbitrary kernel-level file and registry operations, allowing attackers to delete locked files and directories, move files to unconstrained paths, delete registry keys and values, and write new registry values of any type.
The driver's proprietary, undocumented transaction protocol was reverse-engineered by Vinopal, revealing that every configuration blob passed to BTR.sys is RC4-encrypted with a 256-byte key hard-coded in the .rdata section of every BTR.sys build shipped since Windows 7. This encryption method makes it challenging for threat actors to exploit the vulnerability without having administrative privileges.
To exploit the vulnerability, attackers would need to obtain the SeLoadDriverPrivilege, which is required for the BTR.sys driver to function. The researcher developed a proof-of-concept tool, BTR_CLI, which can locate MpEngine.dll under Defender's Definition Updates, extract the embedded BTR.sys binary, construct a valid encrypted transaction, and install the driver as a service via direct HKLM registry writes. This tool can bypass the Service Control Manager entirely and generate no Windows Event ID 7045 (Service Installed) entry.
A live demonstration at Black Hat showed BTR_CLI deleting the entire Defender stack from a fully updated Windows 11 25H2 machine with Tamper Protection active. The demonstration highlighted the severity of the vulnerability and the potential for malicious actors to use the BTR.sys driver to delete security software at boot time.
Check Point Research identified several Sysmon and Windows event conditions as indicators of potential BTR.sys abuse, including Sysmon Event ID 15 (FileCreateStreamHash) where the target filename ends in .sys:changelist, capturing the encrypted configuration Alternate Data Stream written to the driver file. RegistryEvent (Sysmon Event ID 12 or 13) creating a service key whose Args value contains :changelist and whose Group is "Boot Bus Extender," especially when unaccompanied by a Windows Event ID 7045 (Service Installed) entry.
The researcher recommends restricting the assignment of SeLoadDriverPrivilege as the primary hardening control and urges users to keep their software up to date. However, Microsoft has not confirmed a patch for the vulnerability, stating that it does not meet the criteria for immediate servicing.
In a recent disclosure, SentinelLabs researcher Kasif Dekel discovered a privilege escalation vulnerability in the BTR.sys driver five years ago, which was patched by Microsoft on February 9, 2021. It is unclear whether this vulnerability was related to the current BTR.sys vulnerability or if it is a separate issue.
The discovery of the BTR.sys vulnerability highlights the importance of continuous monitoring and vigilance in the cybersecurity landscape. As threat actors become increasingly sophisticated, it is essential for organizations and individuals to stay informed about emerging vulnerabilities and take proactive measures to protect themselves.
The use of a built-in Windows driver as a kernel offensive primitive, rather than a third-party vulnerable one, was previously demonstrated in the context of FIN7's AvNeutralizer, which weaponized the Windows ProcLaunchMon.sys driver alongside the Process Explorer driver to tamper with endpoint security software. This demonstrates the potential for built-in drivers to be exploited by threat actors and underscores the need for robust security measures.
In conclusion, the discovery of the BTR.sys vulnerability highlights a critical weakness in Microsoft Defender's security suite. While the vulnerability itself is not a traditional exploit, the potential for it to be used by threat actors to delete security software at boot time renders Windows users vulnerable. It is essential for users to stay informed about emerging vulnerabilities and take proactive measures to protect themselves.
Related Information:
https://www.ethicalhackingnews.com/articles/Microsoft-Defenders-Own-Driver-Can-Be-Weaponized-to-Delete-Security-Software-at-Boot-A-Threat-to-Windows-Users-ehn.shtml
https://thehackernews.com/2026/08/microsoft-defenders-own-driver-can-be.html
Published: Fri Aug 21 12:35:20 2026 by llama3.2 3B Q4_K_M
