Microsoft Defender BTR.sys Weaponized to Disable Security
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Check Point Research disclosed that Microsoft Defender's legitimate boot-time driver BTR.sys can perform arbitrary kernel-level file and registry operations on Windows 7 through 11 25H2, with no software flaw exploited.
- Threat researcher Jiří Vinopal presented findings at Black Hat USA 2026 and DEF CON 34 in Las Vegas on August 20, 2026, alongside proof-of-concept tool BTR_CLI published on GitHub under MIT license.
- BTR.sys cannot be added to Microsoft's Vulnerable Driver Blocklist or blocked via Windows Defender Application Control without breaking Defender itself, and uses RC4 encryption with a 256-byte key hard-coded across 18 verified 64-bit versions since Windows 7.
- A live Black Hat demonstration showed BTR_CLI deleting the entire Defender stack from a fully updated Windows 11 25H2 machine with Tamper Protection active during a "golden window" before Defender's user-mode services start.
- Microsoft's MSRC confirmed the findings don't meet criteria for immediate servicing because the technique requires SeLoadDriverPrivilege, while Vinopal's GitHub repository states "No patch is planned" — a characterization Microsoft has not publicly confirmed.
- Check Point found no evidence of real-world abuse and noted the technique resembles the bring-your-own-vulnerable-driver approach but relies on a driver shipped in every Windows installation since Windows 7, with FIN7's AvNeutralizer having previously weaponized ProcLaunchMon.sys similarly.
- The same BTR.sys driver was flagged five years earlier for CVE-2021-24092, a privilege escalation flaw disclosed by SentinelLabs' Kasif Dekel in February 2021 and patched by Microsoft on February 9, 2021.
Why it matters: Defenders now have specific Sysmon and Windows event signatures to detect the technique before weaponization, but restricting SeLoadDriverPrivilege is the only recommended hardening — because BTR.sys cannot be blocklisted without breaking Defender itself, and with no patch planned, detection engineering replaces patching as the material path forward.
Ask SkimNews
