Windows machines from Windows 7 to Windows 11 25H2 can be manipulated at the kernel level using Microsoft’s own Defender driver, Check Point Research has found. The technique leans on BTR.sys, the vendor’s legitimately signed boot-time remediation tool, to perform arbitrary file and registry operations without exploiting any flaw or importing an outside driver.
The Boot Time Removal Tool ships inside Defender’s MpEngine.dll and is required for Windows to finish removing locked malware after a reboot. That status shields it from Microsoft’s Vulnerable Driver Blocklist and Windows Defender Application Control, which cannot block the driver without breaking Defender itself.
Researcher Jiri Vinopal reverse-engineered the driver’s undocumented transaction protocol. Every configuration blob passed to BTR.sys is RC4-encrypted with a 256-byte key hard-coded in the .rdata section, unchanged across 18 unique 64-bit builds shipped since Windows 7. The proof-of-concept tool, BTR_CLI, demonstrates the file and registry operations.
Vinopal presented the work at Black Hat USA 2026 and DEF CON 34 and published a research paper on August 20. Check Point found no evidence of real-world abuse, calling the technique currently unknown or unused by threat actors. That makes proactive detection feasible: security teams should watch for unusual BTR.sys invocations before weaponization appears in the wild.
