BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

Strategic summary

The report analyzes the Microsoft-signed Windows Defender Boot-Time Removal driver BTR.sys and shows how this legitimate remediation driver can be abused as a kernel operation primitive without exploits or memory corruption. The researchers reverse engineer the proprietary transaction format and introduce the tool BTR_CLI, which creates valid encrypted transactions to execute arbitrary file and registry operations from the kernel. This allows the driver to be used as an EDR/AV bypass technique that does not rely on typical BYOVD methods. The report warns that trusted security components can unintentionally expose powerful primitives and that similar patterns may exist in other signed remediation drivers.

Key findings

• The signed Microsoft driver BTR.sys can perform arbitrary file and registry operations from the kernel without vulnerabilities or exploits.
• The BTR_CLI tool creates valid encrypted transactions and demonstrates how the legitimate remediation component can become a universal kernel operation engine.
• BTR_CLI enables EDR/AV bypass using a trusted Windows built-in component and without typical BYOVD techniques.
• The research shows that trusted security infrastructure can unintentionally expose powerful primitives and that similar patterns may exist in other signed components.
• The discovery originated from an incident response investigation where suspicious telemetry was traced to legitimate Defender remediation with randomly named drivers.