Full research report

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

BTR Reforged is a living-off-the-land kernel technique, not a conventional vulnerability: it requires no software flaw, imports no external driver, and leaves no Service Control Manager log entry. The architectural weakness—a static RC4 key embedded unchanged across 15 years of Defender builds—means every Windows machine from Windows 7 onward carries the decryption material needed to forge kernel-level transactions. Microsoft's decision not to patch reflects a genuine architectural dilemma: BTR.sys cannot be blocklisted without breaking Defender's own remediation capability. The FIN7 AvNeutralizer precedent shows that financially motivated threat actors do operationalise living-off-the-land driver techniques for EDR neutralisation once they become publicly known; the open-source release of BTR_CLI with prebuilt binaries materially lowers the barrier to adoption. Defenders' best near-term posture is detecting the observable artefacts—ADS creation, SCM-bypass driver registration, and boot-time security-binary deletions—before any threat actor adapts the technique.

What happened

On 20 August 2026, Check Point Research published a paper and proof-of-concept tool (BTR_CLI) demonstrating that Microsoft Defender's legitimately signed boot-time remediation driver, BTR.sys, can be repurposed by a local administrator to perform arbitrary Ring 0 file and registry operations on any Windows system from Windows 7 through Windows 11 25H2. Jiří Vinopal presented the findings as a main-stage briefing at Black Hat USA 2026 and DEF CON 34. The technique, dubbed BTR Reforged, exploits a hardcoded RC4 encryption key—unchanged across 18 identified 64-bit driver builds—to craft valid transactions the driver will execute at kernel level. MSRC reviewed the disclosure and confirmed no patch will be issued, classifying the technique as reliant on pre-existing administrative access rather than a conventional security vulnerability.

Affected scope

All Windows installations from Windows 7 through Windows 11 25H2 that include Microsoft Defender; BTR.sys is embedded in Defender's MpEngine.dll and cannot be removed or blocklisted without breaking Defender. Organisations relying on Defender or third-party endpoint detection and response (EDR) products running on Windows are within scope. No server-edition exclusions were stated.

Technical assessment

BTR.sys is deployed transiently by Defender to remove persistent malware after reboot; it accepts an RC4-encrypted configuration blob delivered via an Alternate Data Stream (.sys:changelist) and executes the specified operations from Ring 0. Vinopal confirmed the same 256-byte RC4 key is hard-coded in every build examined since Windows 7. An attacker holding SeLoadDriverPrivilege can extract the embedded driver binary from MpEngine.dll, construct a valid encrypted transaction, and register the driver via direct HKLM registry writes that bypass the Service Control Manager—generating no Windows Event ID 7045. The driver then executes during the 'golden window': after the filesystem becomes writable at boot, but before Defender's user-mode services initialise. This timing allows deletion of locked security binaries such as WdFilter.sys and MsMpEng.exe before they can protect themselves. The technique is classified as living-off-the-land because the driver is Microsoft-signed and cannot be added to the Vulnerable Driver Blocklist or blocked by Windows Defender Application Control without disabling Defender.

Recommended defensive actions

  1. Audit and restrict SeLoadDriverPrivilege to accounts that operationally require it; remove it from general administrator accounts where possible
  2. Deploy Sysmon and enable Event ID 15 (FileCreateStreamHash) to alert on .sys:changelist Alternate Data Stream creation, and Event ID 6 (DriverLoad) to flag Microsoft-signed driver loads initiated by unexpected parent processes
  3. Hunt for the specific absence of Windows Event ID 7045 coincident with newly registered kernel drivers; this gap is a direct indicator of SCM-bypass service installation
  4. Monitor for SYSTEM process (PID 4) file-deletion or file-move operations targeting known security-product binaries at boot time
  5. Integrate behavioural analytics to detect the pattern of an ADS write followed by a rapid driver service registration and subsequent deletion of endpoint-security binaries

Uncertainties and evidence gaps

  • No patch is planned; Microsoft has characterised the technique as architectural rather than a vulnerability, leaving organisations without a vendor-supplied remediation path
  • Whether threat actors have independently discovered and quietly operationalised the same technique prior to public disclosure is unknown; Check Point Research found no telemetry evidence but acknowledges detection gaps during the pre-filesystem-lock boot phase
  • The extent to which third-party EDR products—distinct from Microsoft Defender—can reliably detect or block BTR_CLI-style execution in their own boot-time protection layers has not been publicly evaluated
  • The supplied reporting identifies CVE-2021-24092, but the reviewed sources did not establish its distinct role in this event.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessLocal Windows administrator account holding SeLoadDriverPrivilege
ComponentBTR.sys (Boot Time Removal Tool) kernel-mode driver embedded in Microsoft Defender's MpEngine.dll across Windows 7 through Windows 11 25H2
MechanismThe driver's proprietary transaction protocol uses a static 256-byte RC4 key hard-coded identically in every build; an administrator can extract the driver binary, craft a valid encrypted transaction blob, and register the driver as a boot-start kernel service via direct registry writes that bypass the Service Control Manager
ImpactRing 0 execution enabling deletion or relocation of locked security binaries and modification of arbitrary registry entries before endpoint-security user-mode services initialise at boot
DetectionSysmon Event ID 15 for .sys:changelist ADS creation; Sysmon Event ID 6 for anomalous Microsoft-signed driver loads; absence of Windows Event ID 7045 on driver registration; SYSTEM process (PID 4) deleting security-product binaries during the boot phase
MitigationNo vendor patch available; restrict SeLoadDriverPrivilege, enforce application-control policies, and deploy Sysmon detection rules targeting ADS creation and unexpected driver-load chains
Exploitation status

No confirmed real-world exploitation; Check Point Research found no evidence of active abuse in telemetry or collected samples as of publication on 20 August 2026.

Research process

The investigation began with the stated CVE (CVE-2021-24092) and the claim that Defender's own driver could be weaponised at boot, which required distinguishing the 2021 privilege-escalation flaw from the 2026 architectural misuse technique. Primary sources—the Check Point Research paper, the BTR_CLI GitHub repository, and the SentinelLabs CVE-2021-24092 disclosure—were all verified by direct fetch. Independent corroboration from SC Media, CyberSecurityNews, and BleepingComputer confirmed key facts and added detection guidance. No threat-actor chatter or dark-web references to active use were found, consistent with Check Point Research's own assessment that the technique is pre-weaponisation.

  1. What is the primary research source for the BTR Reforged technique?
    Searched for 'Check Point Research BTR.sys Defender driver Black Hat 2026 BTR Reforged'

    Identified the Check Point Research paper URL and confirmed Jiří Vinopal as researcher; found BTR_CLI GitHub repository reference

    why Established the primary source before fetching individual pages to avoid relying solely on the untrusted article text

  2. What are the technical details, exploitation requirements, and Microsoft's response in the primary paper?
    Fetched the Check Point Research paper
    research.checkpoint.com ↗

    Confirmed hardcoded RC4 key across 18 builds, SeLoadDriverPrivilege requirement, SCM-bypass via direct registry writes, 'golden window' timing, and MSRC's decision not to patch

    why Primary source provides the authoritative technical account and the vendor response; essential for separating confirmed facts from reporter interpretation

  3. Is the PoC tool publicly available and what does it do?
    Fetched the BTR_CLI GitHub repository
    github.com ↗

    MIT-licensed tool with six kernel primitives, prebuilt x64/x86 binaries, runtime and boot-time trigger modes; published 20 August 2026

    why Confirms PoC availability and capability scope; relevant to defender urgency and detection prioritisation

  4. What is CVE-2021-24092 and how does it relate to the 2026 research?
    Searched for 'CVE-2021-24092 Microsoft Defender BTR.sys SentinelLabs Kasif Dekel' and fetched the SentinelLabs disclosure
    sentinelone.com ↗

    CVE-2021-24092 is a distinct 2021 privilege-escalation flaw in the same driver (hardlink abuse enabling non-admin file overwrite, CVSS 7.8, patched February 2021); it is historical context, not the current technique

    why Clarifies that the 2026 research is a new undocumented-protocol misuse, not a regression of the patched 2021 flaw; prevents conflating two separate issues

  5. Does independent coverage corroborate the exploitation status and technical claims?
    Fetched SC Media brief and CyberSecurityNews article for independent corroboration
    scworld.com ↗

    Both sources confirm no observed real-world attacks, administrative-privilege requirement, and Microsoft's no-patch stance; CyberSecurityNews adds specific Sysmon detection event IDs

    why Two independent domains corroborating the same key facts raises confidence; detection guidance from a third-party source is actionable for defenders

  6. What is the FIN7 AvNeutralizer precedent referenced in the article?
    Searched for 'FIN7 AvNeutralizer ProcLaunchMon.sys EDR killer kernel driver 2024 2025'

    FIN7's AvNeutralizer used Windows' built-in ProcLaunchMon.sys driver alongside the Process Explorer driver to neutralise EDR products in ransomware intrusions from April 2023; sold on Russian-speaking forums for $4,000–$15,000

    why Confirms a realistic threat-actor precedent for weaponising built-in Windows drivers against security products; relevant to assessing likelihood of BTR_CLI adoption

  7. Were any dark-web or threat-actor references to BTR_CLI or BTR Reforged found?
    Reviewed all search results and fetched pages for any OSINT chatter, forum posts, or actor references to the technique

    No dark-web listings, threat-actor forum posts, or incident reports referencing BTR_CLI or BTR Reforged were identified in any source reviewed

    why Absence of chatter is consistent with Check Point Research's own telemetry assessment; supports low current exploitation confidence

Named in this story
ActorsCheck Point ResearchJiří VinopalFIN7
MalwareBTR_CLIAvNeutralizer
TargetsWindows endpoints with Microsoft Defenderenterprise EDR and antivirus deployments
Related CVEs CVE-2021-24092

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (1 primary, 1 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok7 records Primary evidence1 matched items Published the source report used to frame and date the event.
BleepingComputernews ok9 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1674 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5332 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok686 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1009 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok7871 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok4 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok11 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok14 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 7 opened outside the registered collection
References & evidence
Technical references1
github.com/Dump-GUY/BTR_CLI ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

PoC & exploit code1
BTR_CLI – Proof-of-concept offensive tool for BTR.sys github.com ↗

MIT-licensed PoC by Jiří Vinopal implementing six kernel primitives via BTR.sys; prebuilt x64/x86 binaries available

Vendor & gov advisories1
BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive – Check Point Research research.checkpoint.com ↗

Primary research paper by Jiří Vinopal detailing the undocumented protocol, RC4 key, and BTR_CLI; MSRC confirmed no patch planned

Analysis & research4
CVE-2021-24092: 12 Years in Hiding – A Privilege Escalation Vulnerability in Windows Defender – SentinelLabs sentinelone.com ↗

Original 2021 disclosure of a distinct BTR.sys flaw by Kasif Dekel; provides historical context for the same driver component

Black Hat 2026: Check Point Research Takes the Stage – Check Point Blog blog.checkpoint.com ↗

Conference presentation context for BTR Reforged main-stage briefing

Microsoft Defender Driver Can Be Weaponized to Disable EDR and AV From Windows Kernel – CyberSecurityNews cybersecuritynews.com ↗

Includes Sysmon-based detection guidance for the BTR Reforged technique

12-year-old Windows Defender bug gives hackers admin rights – BleepingComputer bleepingcomputer.com ↗

Independent coverage of CVE-2021-24092 confirming patch details and affected product scope