BTR Reforged Weaponizing Defender's Remediation Driver as a ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive
• Blog Title: BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive
• Suggested Section: Windows Hardening > Antivirus (AV) Bypass, with cross-references from Windows Local Privilege Escalation > Dll/Driver-related abuse and Windows post-exploitation; suggested page: Microsoft Defender BTR.sys LOLDriver Abuse

🎯 Content Summary

Overview and security impact

Check Point Research reverse-engineered Microsoft Defender's Boot-Time Removal driver, BTR.sys, and released the MIT-licensed BTR_CLI proof-of-concept with source code and self-contained x64/x86 executables. This is not a memory-corruption vulnerability, has no CVE, and does not provide initial access or privilege escalation. Instead, an attacker who already has administrative control and 🔧 Technical Details

Forging encrypted remediation transactions: A caller able to load kernel drivers can control BTR.sys by placing an encrypted configuration in an NTFS ADS such as Random.sys:changelist and setting the driver's service Args value to that path. A valid blob requires magic 0xFEE1DEAD, version 2, payload offset 0x10, a UTF-16 feedback path, correctly serialized action items, exactly four trailing null bytes per item, and independent modified CRC-32 values. The CRC uses polynomial 0xEDB88320, initial state 0xFFFFFFFF, and no final XOR, producing ~CRC32. The completed structure is RC4-encrypted with the fixed 256-byte key reused across the analyzed BTR builds.

Signed kernel file-operation primitive: Action 1 deletes files, including locked files; Action 2 removes empty directories; and Action 3 moves a source file to an attacker-select...

🤖 Agent Actions

Updated src/windows-hardening/av-bypass.md with a new Microsoft Defender BTR.sys trusted-functionality abuse section covering:

• Preconditions and distinction from BYOVD/LPE.
• Encrypted transaction format and action IDs.
• BTR_CLI runtime and boot-time workflows.
• Early-boot “Golden Window” and anti-forensics.
• Sysmon and Windows event detection correlations.
• Numbered references to the original Check Point research and PoC repository.

Validation passed with git diff --check, structural/citation checks, forbidden-source checks, and HTTP 200 verification for both references. mdbook was unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Antivirus (AV) Bypass, with cross-references from Windows Local Privilege Escalation > Dll/Driver-related abuse and Windows post-exploitation; suggested page: Microsoft Defender BTR.sys LOLDriver Abuse".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0