Microsoft Defender BTR.sys — Signed Driver Abuse Threat Hunt

Threat Overview

Check Point Research reverse engineered Microsoft Defender’s Boot-Time Removal driver (BTR.sys) and demonstrated that the legitimate Microsoft-signed component can be repurposed as a kernel-mode file and registry manipulation primitive. The research tool BTR_CLI can construct the driver’s encrypted transaction format, stage it through an Alternate Data Stream named :changelist, and use the driver during boot to modify protected files or registry data before normal user-mode security services fully initialize.

This is not a conventional memory-corruption vulnerability. Microsoft did not classify the technique for immediate servicing because successful abuse requires pre-existing administrative capability such as SeLoadDriverPrivilege. Check Point stated that it had not observed this weaponization in the wild at publication time.

References

• Check Point Research — BTR Reforged — August 20, 2026
• Check Point Research — August 24 Threat Intelligence Report

Impacted Systems

Vendor / Component	Microsoft Defender Boot-Time Removal driver (BTR.sys), embedded in MpEngine.dll
Platforms demonstrated by researchers	Windows 7 through Windows 11 25H2 across tested samples; actual component availability depends on Defender engine/version
Required attacker capability	Administrative rights / ability to load a kernel driver, including SeLoadDriverPrivilege
Key artifacts	Random eight-character .sys driver names, transient driver service keys, :changelist ADS, BootClean.log
Security impact	Kernel-mode file/registry changes and demonstrated interference with AV/EDR components
Signature	Microsoft-signed legitimate driver
In-the-wild status	No malicious abuse observed by Check Point at publication

What this hunt looks for

Looks for behavior associated with repurposing Defender’s BTR.sys: :changelist Alternate Data Streams, transient driver-service staging, and modification or deletion of Defender security components.

Required logs

Sysmon forwarded to the Event table, especially Event IDs 12, 13, and 15; and DeviceFileEvents from Microsoft Defender for Endpoint.

First-Pass — changelist Alternate Data Stream Activity in Sysmon

Event
| where TimeGenerated >= ago(30d)
| where Source == "Microsoft-Windows-Sysmon"
| where EventID == 15
| where RenderedDescription has ":changelist"
| project TimeGenerated, Computer, EventID, RenderedDescription
| sort by TimeGenerated asc

Follow-Up — Random Driver Service Staging

Event
| where TimeGenerated >= ago(30d)
| where Source == "Microsoft-Windows-Sysmon"
| where EventID in (12,13)
| where RenderedDescription has @"\SYSTEM\CurrentControlSet\Services\"
| where RenderedDescription has_any ("Boot Bus Extender",":changelist","system32\\drivers")
| project TimeGenerated, Computer, EventID, RenderedDescription
| sort by TimeGenerated asc

Follow-Up — Defender Component File Tampering

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("MsMpEng.exe","WdFilter.sys","WdNisDrv.sys","WdBoot.sys")
| where ActionType in ("FileDeleted","FileRenamed","FileModified")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by TimeGenerated asc