Check Point reveals Microsoft Defender driver can delete security software at boot
This digest was compiled by AI from multiple sources — links to the originals are below.
Check Point Research disclosed a technique that uses Microsoft Defender's own signed boot-time driver, BTR.sys, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2. The method requires no software flaw and no external driver import. The findings were presented at Black Hat USA 2026 and DEF CON 34 in Las Vegas on August 20, 2026.
Key Facts
- Check Point Research disclosed the technique at Black Hat USA 2026 and DEF CON 34 in Las Vegas on August 20, 2026.
- The driver BTR.sys is a required Windows component and cannot be added to Microsoft's Vulnerable Driver Blocklist or blocked via Windows Defender Application Control without disrupting Defender.
- The RC4 encryption key for BTR.sys transactions is a 256-byte hard-coded key unchanged across 18 unique 64-bit versions shipped since Windows 7.
- Check Point Research found no evidence the technique has been used in real-world attacks.
The BTR.sys Driver
BTR.sys (Boot Time Removal Tool) is embedded in Defender's MpEngine.dll as the BOOTTIMETOOL resource and is deployed when Defender must finish removing malware after a reboot. The driver is a required Windows component, which means it cannot be added to Microsoft's Vulnerable Driver Blocklist or blocked via Windows Defender Application Control (WDAC) without disrupting Defender itself. Jiří Vinopal, a threat researcher and reverse engineer at Check Point Research, reverse-engineered the driver's proprietary, undocumented transaction protocol. Every configuration blob passed to BTR.sys is RC4-encrypted with a 256-byte key hard-coded in the .rdata section of every BTR.sys build shipped since Windows 7, verified unchanged across 18 unique 64-bit versions.
Proof-of-Concept Tool BTR_CLI
Check Point Research published a proof-of-concept tool, BTR_CLI, alongside the research paper on August 20, 2026. BTR_CLI locates MpEngine.dll under Defender's Definition Updates and extracts the embedded BTR.sys binary. The tool constructs a valid encrypted transaction and installs the driver as a service via direct HKLM registry writes using Type=1, Start=1, and Group="Boot Bus Extender". This installation method bypasses the Service Control Manager entirely and generates no Windows Event ID 7045 (Service Installed) entry.
Boot-Time Execution
When loaded, BTR.sys executes the queued operations from Ring 0, attributed in telemetry to the System process (PID 4). The driver can delete locked files and directories, move files to unconstrained paths including System32\drivers, delete registry keys and values, and write new registry values of any type. A second trigger mode schedules those operations for the next reboot. The driver executes during what Vinopal calls the "golden window," the interval after the filesystem becomes writable but before Defender's user-mode services have started, allowing BTR.sys to physically remove security binaries such as WdFilter.sys and MsMpEng.
2 sources
Check Point reveals Microsoft Defender driver can delete security software at boot
