Executive Summary
At Black Hat USA 2026 and DEF CON 34, Check Point Research unveiled a novel and concerning technique termed "BTR Reforged." The methodology demonstrates how threat actors can abuse Microsoft Defender's legitimate, Microsoft-signed boot-time remediation driver (BTR.sys) as an arbitrary kernel operation primitive. By repurposing this trusted component, an attacker with local administrative privileges can execute kernel-level file and registry deletions before Windows fully initializes, effectively disabling third-party endpoint detection and response (EDR) agents, antivirus software, and system logging tools before their defensive drivers can load. Because BTR.sys is a core, legitimate Windows component embedded within MpEngine.dll, standard defensive mechanisms like the Microsoft Vulnerable Driver Blocklist and Windows Defender Application Control (WDAC) cannot block it without disabling Defender itself.
Deep-Dive Technical Analysis
The attack hinges on the legitimate architecture Microsoft designed for boot-time malware removal:
* Extraction and Registration: BTR.sys (Boot Time Removal Tool) is embedded directly within Microsoft Defender's core engine binary, MpEngine.dll, stored as the BOOTTIMETOOL resource. When Defender schedules a boot-time remediation task, it extracts BTR.sys to disk, registers it as a boot-start driver (SERVICE_BOOT_START), and queues a transaction payload.
* Transaction Queueing: The driver reads operation instructions from an internal transaction format stored in the registry under HKLM\SYSTEM\CurrentControlSet\Services\BTR or custom staging paths. These instructions specify target file paths, driver binaries, and registry keys to be deleted or replaced before the operating system initializes user-space services.
* Execution at Early Boot: Because BTR.sys initializes in the pre-OS environment, it operates with complete kernel-level authority (Ring 0) and precedes the initialization of third-party security agents (such as CrowdStrike, SentinelOne, or Microsoft Defender's own higher-level services).
* Bypassing Driver Blocklists: Unlike traditional Bring Your Own Vulnerable Driver (BYOVD) attacks, "BTR Reforged" requires no external driver delivery. The driver is already present, natively trusted, and cryptographically signed by Microsoft with valid WHQL certificates. It cannot be blocked via WDAC policies or vulnerable driver blocklists without breaking native Windows Defender functionality.
Industry Impact
* Security Software Neutralization: Threat actors can programmatically stage deletions of critical EDR binaries, filter drivers, and database registries, ensuring machines reboot into an unprotected state where ransomware or backdoors can execute unhindered.
* Forensic Evasion: Because file deletions occur during boot-time remediation routines, system event logging services are not yet active, severely impeding post-incident digital forensics and root-cause analysis.
* Architectural Defense Dilemma: The technique turns an essential remediation feature into an evasion vector, highlighting the fundamental challenge of securing privileged pre-boot environments.
Recommendations and Mitigations
1. Registry Access Auditing: Implement strict access control lists (ACLs) and real-time monitoring on HKLM\SYSTEM\CurrentControlSet\Services\BTR and Defender staging keys to detect unauthorized modification or creation of boot-time task queues.
2. Early-Launch Anti-Malware (ELAM) Telemetry: Utilize ELAM drivers configured to validate driver initialization order and verify that staged boot-time deletion queues originate strictly from verified MsMpEng.exe parent processes.
3. Hardened Local Administrator Controls: Enforce Just-In-Time (JIT) access, remove permanent local admin rights, and enforce credential tiering to prevent initial access brokers from achieving the administrative privileges required to stage driver configurations.
4. Behavioral Boot Monitoring: Monitor for unexpected driver load events of BTR.sys during routine system reboots where no prior malware detection alert was logged by central management consoles.