This research reverse engineers Windows Defender’s BTR.sys boot-time remediation driver and shows how its encrypted transaction format can be abused to perform arbitrary file and registry operations from Ring 0. The paper also introduces BTR_CLI, demonstrates EDR/AV bypass and boot-time neutralization against Microsoft Defender, and highlights the defensive implications of a signed built-in LOLDriver. #BTR.sys #BTR_CLI #MicrosoftDefender #MsMpEng.exe #WdFilter.sys #WdBoot.sys #WdNisDrv.sys #Mimikatz #mimidrv.sys #MSRC
Keypoints
- Researchers fully reverse engineered the Windows Defender Boot-Time Removal driver, BTR.sys, including its encryption, integrity checks, and transaction format.
- BTR.sys is a Microsoft-signed remediation driver embedded in MpEngine.dll and dropped only when reboot-based remediation is needed.
- The driver uses an RC4-encrypted ADS-based configuration blob and a custom CRC scheme to validate transaction data.
- By crafting valid transactions, BTR_CLI can trigger kernel-level file deletion, file moves, registry deletion, and registry writes.
- The technique can bypass EDR/AV defenses by executing during a “Golden Window” before user-mode security services fully start.
- The proof of concept can disable Defender components such as WdFilter.sys and MsMpEng.exe and supports boot-time execution via NtLoadDriver.
- Defensive detection should focus on ADS usage, driver load lineage, kernel-mode file deletions, and rapid creation/deletion of BootClean.log.
MITRE Techniques
- [T1014 ] Rootkit – The driver operates from Ring 0 and performs hidden kernel-level actions such as file and registry manipulation (‘the signed Microsoft driver can be instructed to perform arbitrary file and registry operations from Ring 0’).
- [T1543.003 ] Create or Modify System Process: Windows Service – The tool stages the driver by creating a service entry and configuring boot/system start settings (‘Creates a service with a randomized name’ and ‘Configures the service with Start=1’).
- [T1027 ] Obfuscated Files or Information – The configuration blob is RC4-encrypted and integrity-protected to hide its contents (‘contains RC4-encrypted binary data’ and ‘The configuration blob is protected by both encryption and integrity checks’).
- [T1564.004 ] Hide Artifacts: NTFS File Attributes / Alternate Data Streams – The driver configuration and feedback are stored in ADS paths such as :changelist (‘writes the encrypted transaction payload directly into Random.sys:changelist’).
- [T1036 ] Masquerading – The driver is dropped with randomized benign-looking names to resemble legitimate activity (‘randomized filename matching [a-z]{8}.sys’).
- [T1112 ] Modify Registry – The driver can create, delete, and set registry values and keys (‘Arbitrary Registry Write + Registry Creation’ and ‘deletes critical Service Registry keys’).
- [T1070.004 ] File Deletion – The driver deletes files, including security binaries and its own log file (‘Kernel-level deletion’ and ‘deletes its own log file’).
- [T1105 ] Ingress Tool Transfer – The proof of concept stages and drops driver payloads and binaries onto the system (‘extracts the legitimate BTR.sys driver’ and ‘drop the driver file’).
- [T1068 ] Exploitation for Privilege Escalation – The article describes abusing a trusted signed driver to gain powerful kernel primitives without memory corruption (‘without exploits, vulnerabilities, or memory corruption’).
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – The technique neutralizes Defender components and Tamper Protection by removing driver and service registry keys (‘bypasses Tamper Protection’ and ‘dismantle the Windows Defender security stack’).
Indicators of Compromise
- [File names ] Legitimate and renamed driver binaries used for staging and execution – BTR.sys, mzqnjtaq.sys, mlrmqchs.sys
- [Registry paths ] Service keys and Defender-related registry targets – HKLMSYSTEMCurrentControlSetServicesmzqnjtaq, HKLMSYSTEMCurrentControlSetServicesWdFilter
- [ADS paths ] Encrypted configuration and feedback streams – C:Windowssystem32driversmzqnjtaq.sys:changelist, Random.sys:Random.dat
- [File paths ] Boot-time log and Defender binaries targeted for deletion – SystemRootTempBootClean.log, C:WindowsSystem32driverswdWdFilter.sys
- [File paths ] Defender service binary location targeted in the demo – C:ProgramDataMicrosoftWindows DefenderPlatform4.18.26010.5-0MsMpEng.exe
- [Hashes ] Multiple unique BTR.sys builds were analyzed – 18 unique Authentihashes, 5 unique SHA-256 driver builds, and other samples from VirusTotal
- [Tools / binaries ] Proof-of-concept and targeted malicious sample – BTR_CLI.exe, mimidrv.sys