BTR Reforged - Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive

The talk starts with an incident response case. Responders found a service key pointing to a randomly named .sys file whose alternate data stream held its configuration, and first suspected a rootkit. It turned out to be the Boot-Time Removal driver (btr.sys), a Microsoft-signed component that Defender extracts from mpengine.dll only when a remediation needs a reboot. The driver has no IOCTL interface, so its only input is the encrypted configuration stored in that stream.

The speaker documents the format from scratch. The configuration uses RC4 with a 256-byte key that is identical across 18 driver builds spanning roughly Windows 7 to Windows 11, and its integrity checks use a CRC32 variant without the final XOR. The structure has a global header, a feedback file path, and item headers that map to six action IDs covering file deletion, directory deletion, move/quarantine, and registry key, value and set operations. Two actions are especially useful beyond their intended purpose: a move with an empty destination deletes a file, and a move with a valid destination writes without restriction. The companion tool BTR_CLI builds valid transactions and can run them either at runtime or during early boot, in a window before Defender's user-mode services start. The demo removes Defender binaries and registry keys despite tamper protection, then writes a file into a system directory.

The main takeaway for defenders is that no exploit or CVE is involved, and Microsoft did not plan a servicing fix after the report. Detection suggestions include Sysmon events for alternate data stream creation, driver loads paired with file deletions, and tightening the Load Driver privilege.