Malware

BTR_CLI

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1106Native APIEvidence1

Abuse ( BTR_CLI ): Directly interacts with the Registry to create the service keys ( HKLM\SYSTEM\CurrentControlSet\Services\{Random} ) and calls the undocumented NtLoadDriver syscall.

Persistence

4 techniques

T1112Modify RegistryEvidence7

Драјверот може да: брише registry keys и registry values; запишува нови registry values од кој било тип.

T1543.003Windows ServiceEvidence7

Драјверот се инсталира како сервис преку директно запишување во HKLM регистарот , со користење на: Type=1 Start=1 Group="Boot Bus Extender" Овој метод целосно го заобиколува Service Control Manager и не создава запис Windows Event ID 7045 (Service Installed) .

T1547Boot or Logon Autostart ExecutionEvidence4

Вториот режим на активирање ги закажува овие операции за следното рестартирање . Драјверот потоа се извршува во она што Vinopal го нарекува „golden window“

T1547.006Kernel Modules and ExtensionsEvidence1

Boot Execution (trigger boot): Configures the service with Start=1 (System) and Group Boot Bus Extender to execute during the early boot phase, bypassing active EDR/AV protections.

Privilege Escalation

6 techniques

T1068Exploitation for Privilege EscalationEvidence2

Once loaded, BTR.sys executes operations from Ring 0, allowing it to delete or move files, and modify registry entries.

T1543.003Windows ServiceEvidence7

T1547Boot or Logon Autostart ExecutionEvidence4

T1547.006Kernel Modules and ExtensionsEvidence1

Boot Execution (trigger boot): Configures the service with Start=1 (System) and Group Boot Bus Extender to execute during the early boot phase, bypassing active EDR/AV protections.

T1548Abuse Elevation Control MechanismEvidence2

За експлоатацијата е потребна administrator сметка со SeLoadDriverPrivilege , а BTR_CLI автоматски ја активира оваа привилегија за сметки кои веќе ја поседуваат.

T1548.002Bypass User Account ControlEvidence1

WDAC / Microsoft Vulnerable Driver Blocklist cannot block BTR.sys , because it is a required Windows component, not a third-party or vulnerable driver.

Stealth

6 techniques

T1014RootkitEvidence1

TTP # T1014 — Rootkit (Defense Evasion)

T1070.001Clear Windows Event LogsEvidence1

Service creation & triggering - direct HKLM registry writes ... bypass the SCM, so no Event ID 7045 is generated.

T1070.004File DeletionEvidence6

Anti-forensics : BTR_CLI injecte automatiquement une Action 1 ciblant \SystemRoot\Temp\BootClean.log pour supprimer le log du driver avant déchargement

T1211Exploitation for Defense EvasionEvidence1

it exposes how a trusted, Microsoft-signed remediation component can become a Living-off-the-Land driver when its undocumented transaction protocol is reproduced.

T1218System Binary Proxy ExecutionEvidence1

In effect, a valid transaction can direct a signed Microsoft driver to perform privileged operations from Ring 0.

T1564.004NTFS File AttributesEvidence3

use an Alternate Data Stream (ADS) named :changelist for its encrypted configuration

Defense Impairment

3 techniques

T1112Modify RegistryEvidence7

Драјверот може да: брише registry keys и registry values; запишува нови registry values од кој било тип.

T1222File and Directory Permissions ModificationEvidence3

Драјверот може да: брише заклучени датотеки и директориуми; преместува датотеки на произволни патеки, вклучувајќи ја и System32\drivers ; ...

T1553.002Code SigningEvidence1

Technique de bypass EDR/AV sans BYOVD : utilise un driver Microsoft signé légitime

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

Action 3: Move / Quarantine Structure: [Flags] [Source Path] [Dest Path] Effect: Moves a file. Weaponization: If Dest Path is empty, this acts as a Delete operation. If Dest Path is valid, this allows Arbitrary File Write/Move (e.g., dropping a malicious DLL into System32).

Command and Control

1 technique

T1001Data ObfuscationEvidence1

Payload construction - builds the transaction structure ... per-region ~CRC32 checksums, RC4-encrypts the whole blob with the verified key.

Other

2 techniques

T1562Impair DefensesEvidence4

Ова му овозможува на BTR.sys физички да ги отстрани безбедносните бинарни датотеки, како WdFilter.sys и MsMpEng.exe , пред тие да можат да се заштитат од бришење. Во демонстрација во живо ... истражувачите покажале како BTR_CLI го брише целиот Defender stack ... иако била активна Tamper Protection .

T1562.001Disable or Modify ToolsEvidence2

Action 6 : Écriture arbitraire de valeur + création de clé → persistance (Run keys, Services), désactivation de contrôles de sécurité

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Aug 21, 2026

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

A proof-of-concept tool that extracts Defender's embedded BTR.sys driver, builds valid encrypted transactions, installs the driver via direct registry writes, and uses it to perform kernel-level file and registry operations, including disabling or deleting Defender components.

checkpoint research blogNews

Aug 20, 2026

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Check Point Research

A proof-of-concept research/red-team tool that extracts or embeds BTR.sys, builds valid encrypted transaction payloads, stages them via ADS, and triggers the driver to execute chained kernel-level file and registry operations.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

BTR_CLI

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1106Native APIEvidence1

Abuse ( BTR_CLI ): Directly interacts with the Registry to create the service keys ( HKLM\SYSTEM\CurrentControlSet\Services\{Random} ) and calls the undocumented NtLoadDriver syscall.

Persistence

4 techniques

T1112Modify RegistryEvidence7

Драјверот може да: брише registry keys и registry values; запишува нови registry values од кој било тип.

T1543.003Windows ServiceEvidence7

T1547Boot or Logon Autostart ExecutionEvidence4

T1547.006Kernel Modules and ExtensionsEvidence1

Boot Execution (trigger boot): Configures the service with Start=1 (System) and Group Boot Bus Extender to execute during the early boot phase, bypassing active EDR/AV protections.

Privilege Escalation

6 techniques

T1068Exploitation for Privilege EscalationEvidence2

Once loaded, BTR.sys executes operations from Ring 0, allowing it to delete or move files, and modify registry entries.

T1543.003Windows ServiceEvidence7

T1547Boot or Logon Autostart ExecutionEvidence4

T1547.006Kernel Modules and ExtensionsEvidence1

Boot Execution (trigger boot): Configures the service with Start=1 (System) and Group Boot Bus Extender to execute during the early boot phase, bypassing active EDR/AV protections.

T1548Abuse Elevation Control MechanismEvidence2

T1548.002Bypass User Account ControlEvidence1

WDAC / Microsoft Vulnerable Driver Blocklist cannot block BTR.sys , because it is a required Windows component, not a third-party or vulnerable driver.

Stealth

6 techniques

T1014RootkitEvidence1

TTP # T1014 — Rootkit (Defense Evasion)

T1070.001Clear Windows Event LogsEvidence1

Service creation & triggering - direct HKLM registry writes ... bypass the SCM, so no Event ID 7045 is generated.

T1070.004File DeletionEvidence6

Anti-forensics : BTR_CLI injecte automatiquement une Action 1 ciblant \SystemRoot\Temp\BootClean.log pour supprimer le log du driver avant déchargement

T1211Exploitation for Defense EvasionEvidence1

it exposes how a trusted, Microsoft-signed remediation component can become a Living-off-the-Land driver when its undocumented transaction protocol is reproduced.

T1218System Binary Proxy ExecutionEvidence1

In effect, a valid transaction can direct a signed Microsoft driver to perform privileged operations from Ring 0.

T1564.004NTFS File AttributesEvidence3

use an Alternate Data Stream (ADS) named :changelist for its encrypted configuration

Defense Impairment

3 techniques

T1112Modify RegistryEvidence7

Драјверот може да: брише registry keys и registry values; запишува нови registry values од кој било тип.

T1222File and Directory Permissions ModificationEvidence3

T1553.002Code SigningEvidence1

Technique de bypass EDR/AV sans BYOVD : utilise un driver Microsoft signé légitime

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

Command and Control

1 technique

T1001Data ObfuscationEvidence1

Payload construction - builds the transaction structure ... per-region ~CRC32 checksums, RC4-encrypts the whole blob with the verified key.

Other

2 techniques

T1562Impair DefensesEvidence4

T1562.001Disable or Modify ToolsEvidence2

Action 6 : Écriture arbitraire de valeur + création de clé → persistance (Run keys, Services), désactivation de contrôles de sécurité

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Aug 21, 2026

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

checkpoint research blogNews

Aug 20, 2026

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Check Point Research

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.