Malware

BTR.sys

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1574.011Services Registry Permissions WeaknessEvidence1

Weaponization: Can be used to establish persistence (Run keys, Services) or disable security controls (Tamper Protection, EDR configs).

Persistence

4 techniques

T1112Modify RegistryEvidence2

The six kernel primitives BTR.sys exposes are all available: ... 4 Delete Registry Key 5 Delete Registry Value 6 Set Registry Value Creates parent key path if missing.

T1543.003Windows ServiceEvidence2

Service creation & triggering - direct HKLM registry writes ( Type=1, Start=1, ErrorControl=0, Group="Boot Bus Extender" ) bypass the SCM, so no Event ID 7045 is generated. Triggered immediately via NtLoadDriver ( -trigger now ) or scheduled for the next boot

T1547Boot or Logon Autostart ExecutionEvidence1

Triggered immediately via NtLoadDriver ( -trigger now ) or scheduled for the next boot inside the "Golden Window" - the interval where the filesystem is writable but Defender's user-mode services haven't started ( -trigger boot ).

T1547.006Kernel Modules and ExtensionsEvidence1

Boot Execution (trigger boot): Configures the service with Start=1 (System) and Group Boot Bus Extender to execute during the early boot phase, bypassing active EDR/AV protections.

Privilege Escalation

5 techniques

T1068Exploitation for Privilege EscalationEvidence1

the undocumented transaction protocol spoken by BTR.sys - the Microsoft-signed kernel driver that Windows Defender uses to remediate malware at boot time - and shows how that protocol can be driven from user-mode to obtain a permanent, built-in, WDAC-immune Ring-0 file & registry primitive on every modern Windows install.

T1543.003Windows ServiceEvidence2

T1547Boot or Logon Autostart ExecutionEvidence1

T1547.006Kernel Modules and ExtensionsEvidence1

Boot Execution (trigger boot): Configures the service with Start=1 (System) and Group Boot Bus Extender to execute during the early boot phase, bypassing active EDR/AV protections.

T1548.002Bypass User Account ControlEvidence1

WDAC / Microsoft Vulnerable Driver Blocklist cannot block BTR.sys , because it is a required Windows component, not a third-party or vulnerable driver.

Stealth

6 techniques

T1036MasqueradingEvidence1

It is dropped to disk (with a randomized filename matching [a-z]{8}.sys , e.g., mzqnjtaq.sys ) only when a remediation action requires a reboot... accompanied by the following registry entries... At first glance, several characteristics resembled attacker tradecraft: A randomly named driver dropped shortly before reboot Creation of a transient service entry for loading it

T1070.001Clear Windows Event LogsEvidence1

Service creation & triggering - direct HKLM registry writes ... bypass the SCM, so no Event ID 7045 is generated.

T1070.004File DeletionEvidence2

Action 1: Delete File Structure: [Path] Effect: Kernel-level deletion. Bypasses exclusive file locks. | The BTR_CLI tool automatically injects an Action 1 item at the start of the transaction list targeting BootClean.log . Result: The driver creates the log, performs the user’s action, and then deletes its own log file before unloading.

T1218System Binary Proxy ExecutionEvidence1

This classification establishes BTR.sys as a potent “Living-off-the-Land” driver (LOLDriver).

T1564.004NTFS File AttributesEvidence1

Instead of creating visible configuration files, the tool utilizes Alternate Data Streams (ADS). It generates a randomized filename for the driver (e.g., Random.sys) and writes the encrypted transaction payload directly into Random.sys:changelist.

T1574.011Services Registry Permissions WeaknessEvidence1

Weaponization: Can be used to establish persistence (Run keys, Services) or disable security controls (Tamper Protection, EDR configs).

Defense Impairment

1 technique

T1112Modify RegistryEvidence2

The six kernel primitives BTR.sys exposes are all available: ... 4 Delete Registry Key 5 Delete Registry Value 6 Set Registry Value Creates parent key path if missing.

Command and Control

1 technique

T1001Data ObfuscationEvidence1

Payload construction - builds the transaction structure ... per-region ~CRC32 checksums, RC4-encrypts the whole blob with the verified key.

Other

2 techniques

T1562Impair DefensesEvidence1

By exploiting this load order gap, BTR.sys functions as a potent neutralizer for security solutions, including Microsoft Defender and potentially third-party EDRs.

T1562.001Disable or Modify ToolsEvidence1

Tests confirmed the successful deletion of example protected binaries such as WdFilter.sys, MsMpEng.exe and WdNisDrv.sys during boot.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Aug 20, 2026

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Malware Analysis - Malware Analysis, News and Indicators

A legitimate Microsoft-signed Windows Defender remediation driver that can be repurposed to perform arbitrary kernel-mode file and registry operations via encrypted transaction blobs, enabling EDR/AV bypass, tamper-protection bypass, file deletion/move, and registry modification without exploiting a vulnerability.

checkpoint research blogNews

Aug 20, 2026

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Check Point Research

A Microsoft-signed Windows Defender remediation driver that can be repurposed to perform arbitrary kernel-mode file and registry operations via encrypted transaction blobs, enabling EDR/AV bypass, tamper-protection bypass, file deletion/move, and registry modification without exploiting a vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

BTR.sys

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1574.011Services Registry Permissions WeaknessEvidence1

Weaponization: Can be used to establish persistence (Run keys, Services) or disable security controls (Tamper Protection, EDR configs).

Persistence

4 techniques

T1112Modify RegistryEvidence2

The six kernel primitives BTR.sys exposes are all available: ... 4 Delete Registry Key 5 Delete Registry Value 6 Set Registry Value Creates parent key path if missing.

T1543.003Windows ServiceEvidence2

T1547Boot or Logon Autostart ExecutionEvidence1

T1547.006Kernel Modules and ExtensionsEvidence1

Boot Execution (trigger boot): Configures the service with Start=1 (System) and Group Boot Bus Extender to execute during the early boot phase, bypassing active EDR/AV protections.

Privilege Escalation

5 techniques

T1068Exploitation for Privilege EscalationEvidence1

T1543.003Windows ServiceEvidence2

T1547Boot or Logon Autostart ExecutionEvidence1

T1547.006Kernel Modules and ExtensionsEvidence1

Boot Execution (trigger boot): Configures the service with Start=1 (System) and Group Boot Bus Extender to execute during the early boot phase, bypassing active EDR/AV protections.

T1548.002Bypass User Account ControlEvidence1

WDAC / Microsoft Vulnerable Driver Blocklist cannot block BTR.sys , because it is a required Windows component, not a third-party or vulnerable driver.

Stealth

6 techniques

T1036MasqueradingEvidence1

T1070.001Clear Windows Event LogsEvidence1

Service creation & triggering - direct HKLM registry writes ... bypass the SCM, so no Event ID 7045 is generated.

T1070.004File DeletionEvidence2

T1218System Binary Proxy ExecutionEvidence1

This classification establishes BTR.sys as a potent “Living-off-the-Land” driver (LOLDriver).

T1564.004NTFS File AttributesEvidence1

T1574.011Services Registry Permissions WeaknessEvidence1

Weaponization: Can be used to establish persistence (Run keys, Services) or disable security controls (Tamper Protection, EDR configs).

Defense Impairment

1 technique

T1112Modify RegistryEvidence2

The six kernel primitives BTR.sys exposes are all available: ... 4 Delete Registry Key 5 Delete Registry Value 6 Set Registry Value Creates parent key path if missing.

Command and Control

1 technique

T1001Data ObfuscationEvidence1

Payload construction - builds the transaction structure ... per-region ~CRC32 checksums, RC4-encrypts the whole blob with the verified key.

Other

2 techniques

T1562Impair DefensesEvidence1

By exploiting this load order gap, BTR.sys functions as a potent neutralizer for security solutions, including Microsoft Defender and potentially third-party EDRs.

T1562.001Disable or Modify ToolsEvidence1

Tests confirmed the successful deletion of example protected binaries such as WdFilter.sys, MsMpEng.exe and WdNisDrv.sys during boot.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Aug 20, 2026

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Malware Analysis - Malware Analysis, News and Indicators

checkpoint research blogNews

Aug 20, 2026

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Check Point Research

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.