Researchers at Check Point have revealed a method that exploits Microsoft Defender’s boot-time remediation driver, BTR.sys, to execute arbitrary kernel-level operations on Windows systems. This technique, affecting systems from Windows 7 to Windows 11 25H2, does not involve external software vulnerabilities or third-party drivers.
BTR.sys, essential for Windows operations, cannot be added to Microsoft’s Vulnerable Driver Blocklist without impacting Defender’s functionality. The findings were disclosed by Jiří Vinopal at Black Hat USA and DEF CON in Las Vegas, alongside a proof-of-concept tool named BTR_CLI. Check Point Research notes that there is currently no evidence of this method being used in real-world attacks.
BTR.sys Driver Exploitation
The BTR.sys driver resides within Defender’s MpEngine.dll and is deployed to finalize malware removal after a system reboot. Vinopal reverse-engineered its transaction protocol, revealing that all configuration data is RC4-encrypted with a static 256-byte key, consistent across 18 64-bit versions since Windows 7.
BTR_CLI extracts the BTR.sys binary from Defender updates, enabling the creation of encrypted transactions that can install the driver as a service without triggering a Windows Event ID 7045 entry. This bypasses the Service Control Manager, allowing file deletions and registry modifications at the kernel level, operated from Ring 0 during a period when the filesystem is writable but before Defender initiates.
Potential for Real-World Impact
The exploitation requires administrative access, specifically SeLoadDriverPrivilege, which BTR_CLI can enable for eligible accounts. Unlike traditional attacks using third-party vulnerable drivers, this technique leverages a driver integral to Windows installations from version 7 onward.
Check Point’s research emphasizes that this is not a vulnerability in the traditional sense, but rather an exploitation of architectural trust boundaries. Microsoft has acknowledged the findings but indicated that immediate remediation is unnecessary as the technique exploits existing administrative privileges.
Research and Industry Response
The research, originating from a legitimate Defender remediation activity, offers a novel perspective on kernel-level exploits using native Windows drivers. Similar techniques have been seen with FIN7’s AvNeutralizer, which also used built-in Windows drivers for security evasion.
Check Point Research advises restricting SeLoadDriverPrivilege to mitigate risks. They have detailed several Sysmon and Windows event indicators that could signal potential BTR.sys exploitation. While a patch from Microsoft is not imminent, the research highlights the necessity of proactive security measures.
BTR_CLI is available on GitHub, providing researchers and security professionals an opportunity to explore the tool under the MIT license. The broader implications for cybersecurity defenses against such techniques remain a critical area for future focus.
