Check Point weaponizes Microsoft Defender driver for kernel-level file and registry operations
This digest was compiled by AI from multiple sources — links to the originals are below.
Check Point Research found that Microsoft's signed Defender remediation driver BTR.sys can be abused to perform arbitrary file and registry operations from kernel mode. The technique does not exploit a vulnerability but abuses built-in functionality, potentially allowing attackers to tamper with security controls. Microsoft's Security Response Center said the issue did not meet the criteria for immediate servicing.
Key Facts
- Check Point Research reverse-engineered Microsoft's BTR.sys driver and found it can be instructed to perform arbitrary file and registry operations from kernel mode.
- The technique abuses a hard-coded RC4 key and custom CRC-32 integrity check in the driver's encrypted configuration, not a vulnerability.
- CPR released a proof-of-concept tool, BTR_CLI, demonstrating the technique on Windows 7 through fully updated Windows 11 25H2.
- Microsoft's Security Response Center said the issue did not meet the criteria for immediate servicing.
- The researchers identified 18 unique Microsoft-signed 64-bit versions of the driver with the same transaction format and RC4 key.
Driver Abuse Mechanism
BTR.sys is a legitimate Microsoft-signed component used by Defender for remediation requiring a reboot, such as deleting a locked file. The driver reads an encrypted configuration stored in an Alternate Data Stream attached to the driver, rather than exposing a conventional IOCTL interface. Check Point found the configuration uses RC4 encryption with a hard-coded 256-byte key and a custom CRC-32 integrity check. Once decrypted, the configuration contains a sequence of actions like file deletion, directory deletion, file moves, and registry operations. When the destination is set to System32, the file-move primitive can become an arbitrary file-write capability, according to CPR researcher Jiří Vinopal.
Proof of Concept
CPR automated the abuse with BTR_CLI, which extracts the legitimate driver from the local Defender installation, constructs the encrypted transaction, and loads the driver. Using the target machine's own copy of BTR.sys avoids introducing external drivers as with conventional Bring Your Own Vulnerable Driver attacks. The tool demonstrates the technique on Windows versions ranging from Windows 7 through fully updated Windows 11 25H2. The researchers identified 18 unique Microsoft-signed 64-bit versions of the driver and found the same transaction format and RC4 key across the versions examined.
Microsoft Response
Microsoft's Security Response Center found the issue did not meet the criteria for immediate servicing. The attack relies on pre-existing privileges, MSRC reportedly said. The attack path remains open with no evidence of in-the-wild abuse yet. Microsoft did not immediately respond to CSO's request for comment.
1 source
Check Point weaponizes Microsoft Defender driver for kernel-level file and registry operations
