BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive#

Jiří Vinopal (Check Point Research)

• Why: The "trusted security component as attack primitive" pattern taken to its logical end — a Microsoft-signed, always-present driver repurposed for Ring-0 operations without any memory corruption, which classic driver-blocklists can't touch.
• What: First full RE of BTR.sys, the Windows Defender Boot-Time Removal driver: its undocumented RC4-encrypted transaction protocol, hardcoded key, and integrity scheme — unchanged from Windows 7 through 11 25H2. BTR_CLI constructs valid encrypted transactions exercising all six Action IDs (arbitrary file/registry operations). The "Golden Window" executes the primitive after filesystem init but before EDR/AV user-mode services start, neutralizing the security stack on a fully patched Win 11 25H2 without exploits or BYOVD.
• How: Abuse of intended driver functionality via its own encrypted command format; boot-phase timing keeps the operations ahead of EDR file locks. Detection engineering and behavioral hunting guidance included for defenders.
• Where applicable: Every modern Windows fleet (the driver ships with the OS). Constraint: it's a post-exploitation primitive — orchestrating it requires substantial control of the host already — so the impact is EDR evasion/persistence, not initial access. (from abstract only)