![\"\"](\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiCbsmb6Wk8pQKWQmByAl5wnZQEVjS7ZYiHrlsHRM7VlcoPL7s30TaoTReoaQ4LI8Oy3KfKlIRHn9sN_7bjEKd_FWPHi1V0JR6LERepKBWSdJOk6cSUNgfIN2KVc6ydfbTILTy11owREYfpO7K11gFQV00l6qf1zl5rzF28jPhcN744yTvRAA-EjyDSBXs\/s1600\/windows.jpg\")
<\/a><\/div>\nExamine Level Analysis has disclosed a way that makes use of Microsoft Defender’s personal legitimately signed boot-time remediation driver to carry out arbitrary kernel-level file and registry operations on Home windows methods starting from Home windows 7 by Home windows 11 25H2, with no software program flaw exploited and no driver imported from exterior the machine.<\/p>\n
The motive force, BTR.sys (Boot Time Removing Device), is a required Home windows element, which implies it can’t be added to Microsoft’s Weak Driver Blocklist or blocked through Home windows Defender Utility Management (WDAC) with out disrupting Defender itself.<\/p>\n
Ji\u0159\u00ed Vinopal, a menace researcher and reverse engineer at Examine Level Analysis, introduced the findings as a main-stage briefing at Black Hat USA 2026 and DEF CON 34 in Las Vegas and printed the accompanying analysis paper alongside a proof-of-concept device, BTR_CLI, on August 20, 2026. Examine Level Analysis stated it discovered no proof the method has been utilized in real-world assaults.<\/p>\n
“Throughout our evaluation throughout all collected samples and telemetry sources, we didn’t observe proof of real-world abuse of BTR.sys within the method demonstrated on this analysis. This means the method is at the moment unknown or unused by menace actors, making proactive detection engineering possible earlier than weaponization seems within the wild,” Examine Level Analysis stated.<\/p>\n
BTR.sys is embedded in Defender’s Vinopal reverse-engineered the driving force’s proprietary, undocumented transaction protocol and located that each configuration blob handed to BTR.sys is RC4-encrypted with a 256-byte key hard-coded within the BTR_CLI, the proof-of-concept device, locates <\/p>\n The device then constructs a legitimate encrypted transaction.\u00a0It then installs the driving force as a service through direct HKLM registry writes utilizing When loaded, BTR.sys executes the queued operations from Ring 0, attributed in telemetry to the System course of (PID 4), and might delete locked information and directories, transfer information to unconstrained paths together with <\/p>\n A second set off mode schedules these operations for the following reboot.<\/p>\n The motive force then executes throughout what Vinopal calls the “golden window,” the interval after the filesystem turns into writable however earlier than Defender’s user-mode providers have began, permitting BTR.sys to bodily take away safety binaries resembling A stay demonstration at Black Hat confirmed BTR_CLI deleting your complete Defender stack from a totally up to date Home windows 11 25H2 machine with Tamper Safety lively.<\/p>\n Exploitation requires an administrator account with Not like assaults that depend on the carry your individual weak driver<\/a> method, which depend upon known-vulnerable third-party signed drivers that may be added to blocklists, the BTR Reforged method makes use of a driver constructed into each Home windows set up from Home windows 7 onward.<\/p>\n “The problem just isn’t a vulnerability within the conventional sense, however relatively an architectural belief boundary that may be crossed if an attacker already has administrative privileges. Following accountable disclosure, MSRC confirmed that these findings don’t meet the factors for speedy servicing, because the method depends on pre-existing administrative privileges (SeLoadDriverPrivilege),” Examine Level Analysis stated in the paper<\/a>.<\/p>\n Vinopal’s GitHub repository for BTR_CLI provides that “No patch is deliberate,” a characterization Microsoft has not confirmed publicly.<\/p>\n BTR.sys was examined by safety researchers for a special flaw in the identical driver 5 years earlier.<\/p>\n In February 2021, SentinelLabs researcher Kasif Dekel disclosed CVE-2021-24092, a privilege escalation vulnerability that allowed an area non-administrator to overwrite arbitrary information by inserting a tough hyperlink on the driver’s log path. Microsoft patched CVE-2021-24092 on February 9, 2021.<\/p>\n “We assume that this vulnerability remained undiscovered till now as a result of the driving force is generally not current on the laborious drive however relatively dropped and activated when wanted (with a random title) after which purged away,” Kasif Dekel stated within the SentinelLabs disclosure<\/a>.<\/p>\nMpEngine.dll<\/code> because the BOOTTIMETOOL<\/code> useful resource and is deployed when Defender should end eradicating malware after a reboot, deleting information or registry entries that have been locked whereas Home windows was operating.<\/p>\n.rdata<\/code> part of each BTR.sys construct shipped since Home windows 7, verified unchanged throughout 18 distinctive 64-bit variations.<\/p>\nMpEngine.dll<\/code> below Defender’s Definition Updates and extracts the embedded BTR.sys binary.<\/p>\nSort=1<\/code>, Begin=1<\/code>, and Group=\"Boot Bus Extender\"<\/code>, a way that bypasses the Service Management Supervisor solely and generates no Home windows Occasion ID 7045 (Service Put in) entry.<\/p>\nSystem32drivers<\/code>, delete registry keys and values, and write new registry values of any kind.<\/p>\nWdFilter.sys<\/code> and MsMpEng.exe<\/code> earlier than they will lock themselves.<\/p>\nSeLoadDriverPrivilege<\/code>, which BTR_CLI auto-enables for accounts that already maintain it.<\/p>\n