Microsoft Defender's Built-In Driver Can Erase Security Files, Researchers Find

Security researchers at Check Point Research have uncovered a method that exploits Microsoft Defender's own legitimately signed driver to carry out unrestricted kernel-level file and registry actions on Windows systems from Windows 7 through Windows 11 25H2. The driver, BTR.sys—short for Boot Time Removal Tool—is a mandatory Windows component, which means it can't be added to Microsoft's Vulnerable Driver Blocklist or blocked through Windows Defender Application Control without breaking Defender itself. Jiří Vinopal, a threat researcher and reverse engineer at Check Point Research, revealed the findings in a main-stage briefing at Black Hat USA 2026 and DEF CON 34 in Las Vegas and released the research paper along with a proof-of-concept tool called BTR_CLI on August 20, 2026.

BTR.sys sits embedded in Defender's MpEngine.dll as the BOOTTIMETOOL resource and gets deployed when Defender needs to complete malware removal after a reboot, erasing files or registry entries that were locked during Windows operation. Vinopal reverse-engineered the driver's proprietary, undocumented transaction protocol and discovered that every configuration blob sent to BTR.sys is RC4-encrypted using a 256-byte key hard-coded in the .rdata section of every BTR.sys build shipped since Windows 7, confirmed identical across 18 distinct 64-bit versions. The proof-of-concept tool locates MpEngine.dll under Defender's Definition Updates and pulls out the embedded BTR.sys binary, then builds a valid encrypted transaction and installs the driver as a service through direct HKLM registry writes using Type=1, Start=1, and Group="Boot Bus Extender"—a technique that sidesteps the Service Control Manager entirely and produces no Windows Event ID 7045 (Service Installed) entry. Once loaded, BTR.sys runs the queued operations from Ring 0, logged in telemetry to the System process (PID 4), and can delete locked files and directories, move files to unlimited paths including System32\drivers, delete registry keys and values, and write new registry values of any type. A live demonstration at Black Hat showed BTR_CLI wiping the entire Defender stack from a fully updated Windows 11 25H2 machine with Tamper Protection turned on.

"During our analysis across all collected samples and telemetry sources, we did not observe evidence of real-world abuse of BTR.sys in the manner demonstrated in this research," Check Point Research said. The researchers found no evidence the technique has been used in actual attacks, suggesting "the technique is currently unknown or unused by threat actors, making proactive detection engineering feasible before weaponization appears in the wild." The report adds that "the issue is not a vulnerability in the traditional sense, but rather an architectural trust boundary that can be crossed if an attacker already has administrative privileges," and notes that Microsoft's Security Response Center confirmed the findings don't meet criteria for immediate servicing because the technique depends on pre-existing administrative privileges—specifically SeLoadDriverPrivilege. Vinopal's GitHub repository for BTR_CLI states "No patch is planned," though Microsoft hasn't confirmed that characterization publicly.

Unlike attacks that depend on the bring-your-own-vulnerable-driver technique, which relies on known-vulnerable third-party signed drivers that can be added to blocklists, the BTR Reforged technique uses a driver built into every Windows installation from Windows 7 forward. The driver runs during what Vinopal calls the "golden window"—the interval after the filesystem becomes writable but before Defender's user-mode services have started—allowing BTR.sys to physically delete security binaries such as WdFilter.sys and MsMpEng.exe before they can lock themselves. Exploitation requires an administrator account with SeLoadDriverPrivilege, which BTR_CLI auto-enables for accounts that already possess it. BTR.sys was examined by security researchers for a different flaw in the same driver five years earlier; in February 2021, SentinelLabs researcher Kasif Dekel disclosed CVE-2021-24092, a privilege escalation vulnerability that let a local non-administrator overwrite arbitrary files by placing a hard link at the driver's log path, which Microsoft patched on February 9, 2021.

Check Point Research has identified several detection opportunities, including Sysmon Event ID 15 where the target filename ends in .sys:changelist (capturing the encrypted configuration Alternate Data Stream written to the driver file), RegistryEvent creating a service key whose Args value contains :changelist and whose Group is "Boot Bus Extender" without an accompanying Windows Event ID 7045 entry, and Sysmon Event ID 6 (DriverLoad) immediately followed by Event ID 23 (FileDelete) attributed to the System process (PID 4). The report recommends restricting the assignment of SeLoadDriverPrivilege as the primary hardening control. BTR_CLI is available at github.com/Dump-GUY/BTR_CLI under the MIT license, with prebuilt x64 and x86 binaries attached to the repository's releases. Organizations that have already hardened privilege boundaries may find their existing controls sufficient, but the disclosure forces a deeper conversation about whether certain administrative capabilities remain defensible when the tools meant to protect systems can be turned against themselves.