MalwareExploits 1 CVE

BTR.sys

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2021-24092Microsoft Defender Elevation of Privilege Vulnerability

Драјверот, BTR.sys (Boot Time Removal Tool), е задолжителна компонента на Windows... BTR.sys е вграден во MpEngine.dll на Defender како ресурс BOOTTIMETOOL и се распоредува кога Defender мора да заврши со отстранувањето на malware по рестартирање.

via mkd cirtmkd-cirt.mk

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1574.011Services Registry Permissions WeaknessEvidence1

Weaponization: Can be used to establish persistence (Run keys, Services) or disable security controls (Tamper Protection, EDR configs).

Persistence

4 techniques

T1112Modify RegistryEvidence7

Драјверот може да: брише registry keys и registry values; запишува нови registry values од кој било тип.

T1543.003Windows ServiceEvidence6

Драјверот се инсталира како сервис преку директно запишување во HKLM регистарот , со користење на: Type=1 Start=1 Group="Boot Bus Extender" Овој метод целосно го заобиколува Service Control Manager и не создава запис Windows Event ID 7045 (Service Installed) .

T1547Boot or Logon Autostart ExecutionEvidence4

Вториот режим на активирање ги закажува овие операции за следното рестартирање . Драјверот потоа се извршува во она што Vinopal го нарекува „golden window“

T1547.006Kernel Modules and ExtensionsEvidence1

Boot Execution (trigger boot): Configures the service with Start=1 (System) and Group Boot Bus Extender to execute during the early boot phase, bypassing active EDR/AV protections.

Privilege Escalation

5 techniques

T1068Exploitation for Privilege EscalationEvidence3

Once loaded, BTR.sys executes operations from Ring 0, allowing it to delete or move files, and modify registry entries.

T1543.003Windows ServiceEvidence6

T1547Boot or Logon Autostart ExecutionEvidence4

T1547.006Kernel Modules and ExtensionsEvidence1

Boot Execution (trigger boot): Configures the service with Start=1 (System) and Group Boot Bus Extender to execute during the early boot phase, bypassing active EDR/AV protections.

T1548.002Bypass User Account ControlEvidence1

WDAC / Microsoft Vulnerable Driver Blocklist cannot block BTR.sys , because it is a required Windows component, not a third-party or vulnerable driver.

Stealth

8 techniques

T1014RootkitEvidence1

TTP # T1014 — Rootkit (Defense Evasion)

T1027Obfuscated Files or InformationEvidence1

Configuration : lue depuis un Alternate Data Stream (ADS) ( :changelist ) chiffré par RC4 avec une clé de 256 octets codée en dur dans la section .rdata

T1036MasqueradingEvidence1

It is dropped to disk (with a randomized filename matching [a-z]{8}.sys , e.g., mzqnjtaq.sys ) only when a remediation action requires a reboot... accompanied by the following registry entries... At first glance, several characteristics resembled attacker tradecraft: A randomly named driver dropped shortly before reboot Creation of a transient service entry for loading it

T1070.004File DeletionEvidence6

Anti-forensics : BTR_CLI injecte automatiquement une Action 1 ciblant \SystemRoot\Temp\BootClean.log pour supprimer le log du driver avant déchargement

T1211Exploitation for StealthEvidence1

it exposes how a trusted, Microsoft-signed remediation component can become a Living-off-the-Land driver when its undocumented transaction protocol is reproduced.

T1218System Binary Proxy ExecutionEvidence2

In effect, a valid transaction can direct a signed Microsoft driver to perform privileged operations from Ring 0.

T1564.004NTFS File AttributesEvidence3

Configuration : lue depuis un Alternate Data Stream (ADS) ( :changelist )

T1574.011Services Registry Permissions WeaknessEvidence1

Weaponization: Can be used to establish persistence (Run keys, Services) or disable security controls (Tamper Protection, EDR configs).

Defense Impairment

5 techniques

T1112Modify RegistryEvidence7

Драјверот може да: брише registry keys и registry values; запишува нови registry values од кој било тип.

T1222File and Directory Permissions ModificationEvidence3

Драјверот може да: брише заклучени датотеки и директориуми; преместува датотеки на произволни патеки, вклучувајќи ја и System32\drivers ; ...

T1553.002Code SigningEvidence1

Technique de bypass EDR/AV sans BYOVD : utilise un driver Microsoft signé légitime

T1685Disable or Modify ToolsEvidence5

Ова му овозможува на BTR.sys физички да ги отстрани безбедносните бинарни датотеки, како WdFilter.sys и MsMpEng.exe , пред тие да можат да се заштитат од бришење. Во демонстрација во живо ... истражувачите покажале како BTR_CLI го брише целиот Defender stack ... иако била активна Tamper Protection .

T1685.005Clear Windows Event LogsEvidence1

Service creation & triggering - direct HKLM registry writes ... bypass the SCM, so no Event ID 7045 is generated.

Command and Control

1 technique

T1001Data ObfuscationEvidence1

Payload construction - builds the transaction structure ... per-region ~CRC32 checksums, RC4-encrypts the whole blob with the verified key.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mkd cirtNews

Aug 24, 2026

Сопствениот драјвер на Microsoft Defender може да се злоупотреби за бришење на безбедносен софтвер при подигнување на системот | MKD-CIRT | Национален центар за одговор на компјутерски инциденти

Легитимно потпишан Microsoft Defender boot-time remediation драјвер кој може да биде weaponized за kernel-level бришење, преместување и запишување на датотеки и registry entries, вклучително и отстранување на Defender компоненти пред тие да се стартуваат.

malware newsNews

Aug 20, 2026

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Malware Analysis - Malware Analysis, News and Indicators

A legitimate Microsoft-signed Windows Defender remediation driver that can be repurposed to perform arbitrary kernel-mode file and registry operations via encrypted transaction blobs, enabling EDR/AV bypass, tamper-protection bypass, file deletion/move, and registry modification without exploiting a vulnerability.

checkpoint research blogNews

Aug 20, 2026

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Check Point Research

A Microsoft-signed Windows Defender remediation driver that can be repurposed to perform arbitrary kernel-mode file and registry operations via encrypted transaction blobs, enabling EDR/AV bypass, tamper-protection bypass, file deletion/move, and registry modification without exploiting a vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

BTR.sys

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2021-24092Microsoft Defender Elevation of Privilege Vulnerability

via mkd cirtmkd-cirt.mk

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1574.011Services Registry Permissions WeaknessEvidence1

Weaponization: Can be used to establish persistence (Run keys, Services) or disable security controls (Tamper Protection, EDR configs).

Persistence

4 techniques

T1112Modify RegistryEvidence7

Драјверот може да: брише registry keys и registry values; запишува нови registry values од кој било тип.

T1543.003Windows ServiceEvidence6

T1547Boot or Logon Autostart ExecutionEvidence4

T1547.006Kernel Modules and ExtensionsEvidence1

Boot Execution (trigger boot): Configures the service with Start=1 (System) and Group Boot Bus Extender to execute during the early boot phase, bypassing active EDR/AV protections.

Privilege Escalation

5 techniques

T1068Exploitation for Privilege EscalationEvidence3

Once loaded, BTR.sys executes operations from Ring 0, allowing it to delete or move files, and modify registry entries.

T1543.003Windows ServiceEvidence6

T1547Boot or Logon Autostart ExecutionEvidence4

T1547.006Kernel Modules and ExtensionsEvidence1

Boot Execution (trigger boot): Configures the service with Start=1 (System) and Group Boot Bus Extender to execute during the early boot phase, bypassing active EDR/AV protections.

T1548.002Bypass User Account ControlEvidence1

WDAC / Microsoft Vulnerable Driver Blocklist cannot block BTR.sys , because it is a required Windows component, not a third-party or vulnerable driver.

Stealth

8 techniques

T1014RootkitEvidence1

TTP # T1014 — Rootkit (Defense Evasion)

T1027Obfuscated Files or InformationEvidence1

Configuration : lue depuis un Alternate Data Stream (ADS) ( :changelist ) chiffré par RC4 avec une clé de 256 octets codée en dur dans la section .rdata

T1036MasqueradingEvidence1

T1070.004File DeletionEvidence6

Anti-forensics : BTR_CLI injecte automatiquement une Action 1 ciblant \SystemRoot\Temp\BootClean.log pour supprimer le log du driver avant déchargement

T1211Exploitation for StealthEvidence1

it exposes how a trusted, Microsoft-signed remediation component can become a Living-off-the-Land driver when its undocumented transaction protocol is reproduced.

T1218System Binary Proxy ExecutionEvidence2

In effect, a valid transaction can direct a signed Microsoft driver to perform privileged operations from Ring 0.

T1564.004NTFS File AttributesEvidence3

Configuration : lue depuis un Alternate Data Stream (ADS) ( :changelist )

T1574.011Services Registry Permissions WeaknessEvidence1

Weaponization: Can be used to establish persistence (Run keys, Services) or disable security controls (Tamper Protection, EDR configs).

Defense Impairment

5 techniques

T1112Modify RegistryEvidence7

Драјверот може да: брише registry keys и registry values; запишува нови registry values од кој било тип.

T1222File and Directory Permissions ModificationEvidence3

T1553.002Code SigningEvidence1

Technique de bypass EDR/AV sans BYOVD : utilise un driver Microsoft signé légitime

T1685Disable or Modify ToolsEvidence5

T1685.005Clear Windows Event LogsEvidence1

Service creation & triggering - direct HKLM registry writes ... bypass the SCM, so no Event ID 7045 is generated.

Command and Control

1 technique

T1001Data ObfuscationEvidence1

Payload construction - builds the transaction structure ... per-region ~CRC32 checksums, RC4-encrypts the whole blob with the verified key.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Malware Analysis - Malware Analysis, News and Indicators

checkpoint research blogNews

Aug 20, 2026

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Check Point Research

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.