protocols

Check Point Research revealed a technique that uses the boot-time remediation driver BTR.sys, part of Windows Defender, to execute kernel-level operations on Windows systems from Windows 7 to Windows 11 25H2. This method does not exploit software vulnerabilities but leverages BTR.sys, which is designed to remove locked malware components. Researchers reverse-engineered its undocumented protocol, leading to the creation of a proof-of-concept tool, BTR_CLI, that can install the driver as a service without standard management protocols. Once operational, BTR.sys can delete or move files, modify registry entries, and remove security binaries, including parts of Defender, during a specific period when the file system is writable. To exploit this technique, an attacker needs administrator privileges, specifically SeLoadDriverPrivilege. Although Microsoft does not consider this a critical issue due to the requirement of pre-existing administrative access, it highlights a significant potential vulnerability. There have been no documented real-world attacks using this technique.