Published · 2d agoSecurity3 min read
Defender's own boot driver is a kernel delete primitive, and Microsoft is not servicing it
Check Point's BTR Reforged turns a required Defender component into Ring 0 file and registry deletion on Windows 7 through 11 25H2. It cannot be blocklisted, so detection is the only lever left.
Not a builder's beat, but builders have a standing stake in it.See today for builders
What happened
- Check Point Research disclosed a technique that uses Microsoft Defender's legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine.
- BTR.sys (Boot Time Removal Tool) is a required Windows component, which means it cannot be added to Microsoft's Vulnerable Driver Blocklist or blocked via Windows Defender Application Control without disrupting Defender itself.
- Jiri Vinopal, a threat researcher and reverse engineer at Check Point Research, presented the findings as a main-stage briefing at Black Hat USA 2026 and DEF CON 34 in Las Vegas and published the research paper alongside a proof-of-concept tool, BTR_CLI, on August 20, 2026.
- Check Point Research said that across all collected samples and telemetry sources it did not observe evidence of real-world abuse of BTR.sys in the manner demonstrated, suggesting the technique is currently unknown or unused by threat actors and that proactive detection engineering is feasible before weaponization appears in the wild.
- BTR.sys is embedded in Defender's MpEngine.dll as the BOOTTIMETOOL resource and is deployed when Defender must finish removing malware after a reboot, deleting files or registry entries that were locked while Windows was running. BTR_CLI locates MpEngine.dll under Defender's Definition Updates and extracts the embedded BTR.sys binary.
Compiled by The WatchSomething wrong?How this is made
Why it matters
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Check Point Research disclosed a technique that uses Microsoft Defender's legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine.
- [2]
BTR.sys (Boot Time Removal Tool) is a required Windows component, which means it cannot be added to Microsoft's Vulnerable Driver Blocklist or blocked via Windows Defender Application Control without disrupting Defender itself.
ReportedView cited source - [3]
Jiri Vinopal, a threat researcher and reverse engineer at Check Point Research, presented the findings as a main-stage briefing at Black Hat USA 2026 and DEF CON 34 in Las Vegas and published the research paper alongside a proof-of-concept tool, BTR_CLI, on August 20, 2026.
ReportedView cited source - [4]
Check Point Research said that across all collected samples and telemetry sources it did not observe evidence of real-world abuse of BTR.sys in the manner demonstrated, suggesting the technique is currently unknown or unused by threat actors and that proactive detection engineering is feasible before weaponization appears in the wild.
- [5]
BTR.sys is embedded in Defender's MpEngine.dll as the BOOTTIMETOOL resource and is deployed when Defender must finish removing malware after a reboot, deleting files or registry entries that were locked while Windows was running. BTR_CLI locates MpEngine.dll under Defender's Definition Updates and extracts the embedded BTR.sys binary.
ReportedView cited source - [6]
Every configuration blob passed to BTR.sys is RC4-encrypted with a 256-byte key hard-coded in the .rdata section of every BTR.sys build shipped since Windows 7, verified unchanged across 18 unique 64-bit versions.
ReportedView cited source
Sources & coverage · 2 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- scworld.comSC StaffyesterdayResearchers find way to weaponize Windows Defender's own driver
- thehackernews.comyesterday
