Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesShort answer: Check Point Research says Windows Defender’s legitimate Boot-Time Removal driver, BTR.sys, contains an undocumented transaction mechanism that can perform kernel-mode file and registry operations when properly staged. That does not make it a privilege-escalation vulnerability: the technique requires an attacker to already control an administrator-level context, including SeLoadDriverPrivilege. The defensive question is therefore not whether the Microsoft signature is valid, but whether the driver’s staging, service configuration, process lineage and timing match an expected Defender or Malicious Software Removal Tool (MRT) remediation.
Check Point Research’s August 20, 2026 report describes a signed Defender remediation component being repurposed as a general kernel operation primitive. The component is BTR.sys, a one-shot driver intended to remove or move files that cannot be handled while Windows is running normally. Researchers reconstructed the driver’s transaction format and report that it can carry out file and registry actions from kernel mode, including during an early system-start window.
As an Amazon Associate I earn from qualifying purchases.
The distinction between capability and prerequisite is essential. The report does not describe memory corruption, a security-boundary escape, or a way for an ordinary user to obtain administrator rights. Loading and configuring the driver requires pre-existing administrative control, including the Windows SeLoadDriverPrivilege. Jiří Vinopal of Check Point Research summarizes the boundary this way: “The issue is not a vulnerability in the traditional sense, but rather an architectural trust boundary that can be crossed if an attacker already has administrative privileges.” (Check Point Research, August 20, 2026.)
Recommended Free Tools
What BTR.sys is supposed to do
A reboot-time cleanup component
BTR.sys is described as a legitimate, one-shot Defender remediation driver embedded as a PE resource in MpEngine.dll. When remediation must continue after a reboot—for example, because a malicious or otherwise locked file cannot be removed in user mode—the Defender engine extracts the driver to disk under a randomized filename. It then creates the necessary service configuration, loads the driver, gives it a transaction to process, receives status through a feedback file, and asks it to unload itself.
#1 Best Overall
This design addresses a real operating-system constraint: some files and registry objects are unavailable to ordinary processes while the system is active. A driver that runs during system startup can act before the normal Defender user-mode service begins. Under its intended workflow, the driver exists briefly, performs the queued cleanup, reports the result and disappears.
Why a trusted driver attracted scrutiny
The incident that prompted the investigation initially looked like suspicious driver activity. Check Point says the telemetry was ultimately traced to legitimate Defender remediation, but the investigation exposed a broader architectural property: the same signed driver accepts a transaction description that is not limited to one hard-coded cleanup action. If an administrator can stage that transaction and make the service load the driver, the driver’s own kernel privileges perform the requested operations.
How the undocumented transaction path works
Service configuration points to an alternate data stream
According to the report, BTR.sys does not use a conventional IOCTL interface for this configuration path. Instead, a registry value named Args in the driver’s service key points to an NTFS alternate data stream (ADS), conventionally named :changelist. The stream contains the transaction that the driver reads when it starts.
Check Point describes the transaction as RC4-encrypted and protected by modified CRC-32 integrity checks. Its structure includes a global header, a feedback-file path and individual operation records. Those implementation details explain why a normal file scan may not reveal the intent: the payload is stored in a stream attached to a file, while the service registry value supplies the driver with the location.
This architectural description is useful for defenders, but it should not be treated as a recipe for constructing a payload. The practical detection value is the combination of artifacts: a newly created :changelist stream, an Args value that references it, a short-lived or unusual kernel-driver service, and activity in the surrounding boot or remediation timeline.
Operations the researchers mapped
Check Point reports reconstructing transaction items that can direct the driver to perform the following categories of action:
- Delete a file.
- Delete an empty directory.
- Move or quarantine a file.
- Delete a registry key or registry value.
- Set a registry value.
Those actions are consistent with a remediation driver’s legitimate mission, but the same interface can be broader than the single cleanup operation an analyst might expect from a particular Defender alert. The report’s claim is about what the reconstructed transaction mechanism can do, not about a new privilege that the driver grants to an unprivileged process.
What was tested—and what that evidence does not prove
The Check Point article reports tests on Windows 7 Build 7601, Windows 8.1, Windows 10 22H2 and Windows 11 25H2, with the work described as current to July 2026. These are the researchers’ test results. They are not an independent reproduction, a guarantee that every build behaves identically, or a population statistic about how often the technique occurs.
The authors also say they did not observe real-world use during their analysis. That is a bounded observation of the cases they examined, not evidence that abuse has never happened. A defender should use the report to understand a suspicious sequence and investigate its context, rather than assign a threat-actor campaign or prevalence rate that the sources do not establish.
Why the boot phase changes the risk picture
System-start, not boot-start
The report distinguishes two Windows driver-start modes. BTR.sys cannot run as a SERVICE_BOOT_START driver (Start=0) because its initialization performs file I/O before the required boot infrastructure is available. Check Point says it instead uses SERVICE_SYSTEM_START (Start=1) and a load-order group that allows execution early in the system-start phase.
The observed timeline
In the researchers’ boot-logging demonstration, BTR actions occurred before the Defender user-mode service started. That ordering matters: a driver can make changes before many familiar user-mode security controls and telemetry sources are active. It does not mean that every Windows installation will produce exactly the same timestamps or ordering. Treat the timeline as the paper’s observed test behavior, then verify it against the event records, service configuration and boot logs on the affected host.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Is this a Defender bypass or a vulnerability?
It can be described as a way to use a trusted security component for operations outside its ordinary remediation scenario, but calling it a conventional Defender-bypass vulnerability would be misleading. The prerequisite is the decisive fact: the operator must already possess administrative capability, including SeLoadDriverPrivilege, to configure and load the driver. The technique therefore helps an already privileged intruder alter files or registry data in a kernel context; it does not explain how that intruder became an administrator.
Check Point says MSRC considered the issue ineligible for immediate servicing because of that pre-existing-privilege requirement. That servicing account is reported by Check Point Research; the material available for this article does not include a separate Microsoft statement. The researchers frame the matter as abuse of intended functionality and a trust-boundary problem rather than a memory-safety flaw.
Legitimate remediation can look almost identical
A high-severity alert is a lead for investigation, not proof of compromise. The original Check Point case began with telemetry that appeared suspicious but was attributed to legitimate Defender remediation. Elastic’s investigation guidance likewise warns that legitimate Defender or MRT activity can resemble the suspicious pattern.
| Signal | Why it can be legitimate | Questions that raise concern |
|---|---|---|
:changelist ADS creation |
A scheduled or triggered remediation may stage a transaction for a locked file. | Was the stream created by an expected security process, at an expected time, on an expected path? |
Service Args value referencing the stream |
The value is part of BTR’s documented-by-observation transaction workflow. | Was the service newly created or modified by an unknown process, account or script? |
| Randomized driver filename | Check Point says the Defender engine drops BTR.sys under a randomized filename. | Does the image path, signature, parent process and service metadata match a Defender remediation sequence? |
| Early-boot file or registry changes | Removing a locked object may require system-start execution. | Are there unrelated security-component changes, unexplained persistence changes or no corresponding remediation evidence? |
Feedback files or BootClean.log activity |
These can be normal status and cleanup artifacts. | Do the artifacts describe a known remediation, or do they appear alongside suspicious staging and process lineage? |
Signature validation is still useful, but it answers only who signed a binary, not who staged it or why. A valid Microsoft signature on the driver should be combined with path, service values, creating process, user, timing and related remediation records.
Detection: start with the staging behavior
Elastic’s rule as a concrete example
Elastic’s prebuilt rule “Potential Evasion via Boot Time Removal Tool” is labeled high severity. It looks for either creation of a :changelist NTFS alternate data stream or a Windows service Args registry value that points to such a stream. The rule excludes a specific legitimate Microsoft-signed MRT.exe running as SYSTEM, while its documentation cautions that other legitimate remediation can still resemble the alert. (Elastic detection rule and investigation guide.)
Best Value
The rule is best used as an investigation trigger. The sources do not provide a head-to-head vendor effectiveness study, so its existence should not be presented as proof that one product defeats the technique or catches every variant.
Telemetry worth correlating
- Creation of an NTFS ADS named
:changelist, including the host, file path, creating process and user. - Creation or modification of a driver service and its
Args,ImagePath,TypeandGroupvalues. - The image’s signature, on-disk location, hash and randomized filename.
- Driver-load events and the complete process tree that staged the service or stream.
- Feedback artifacts,
BootClean.logentries and related security-binary changes. - Reboot timing and evidence of a normal Defender or MRT remediation request.
Incident triage: a defensible order of operations
When the signal is unexplained, preserve evidence before deleting the staged objects. Elastic recommends the following investigative sequence, which can be adapted to the telemetry available in your environment:
- Classify the trigger. Determine whether the alert came from ADS creation, a service registry change, or both. Record exact paths, timestamps and event IDs.
- Identify the staging process. Capture the process, parent, command line, user, integrity level and signer. An expected Defender or MRT lineage is materially different from a script host, office process or unknown administrator tool.
- Inspect the service. Export the service key and record
ImagePath,Args,Type,StartandGroup. Look for a corresponding normal service-install event and for sibling values that do not fit the expected BTR pattern. - Examine the driver and stream. Preserve the driver file and ADS, then record location, signature, hash and creation times. Do not assume that a valid signature resolves the intent question.
- Correlate the boot window. Review driver loads, reboot events, feedback artifacts and
BootClean.logactivity. Compare the sequence with a known Defender or MRT remediation if one was scheduled. - Assess privilege exposure. Identify which account or service held
SeLoadDriverPrivilege, how it obtained that right and whether the account’s activity is expected. - Contain only after collection. If the staging is unauthorized, remove the service and ADS through your incident-response procedure, isolate the host as appropriate, restore altered security components from known-good media when necessary, and review for additional file or registry changes.
Hardening priorities
Restrict driver-loading privilege
Limit SeLoadDriverPrivilege to the smallest set of trusted accounts and services. Review local and domain policy assignments, remove unnecessary grants and alert on unexpected use. The technique’s prerequisite makes this control more valuable than attempting to block every possible filename or signature.
Free tools Windows power users keep installed
One-click scans. No signup required.
Monitor behavior, not just trust metadata
Alert when security drivers execute outside their expected process lineage, when a service Args value points to an ADS, or when a :changelist stream appears without a matching remediation event. Keep enough process, registry, driver and boot telemetry to reconstruct who staged the operation.
Preserve legitimate exceptions
Do not create a blanket rule that treats every BTR-related artifact as malware. Defender and MRT remediation can generate the same classes of evidence. Detection logic should allow a documented, time-correlated remediation path while still escalating unexplained creators, unusual accounts, unrelated targets or service settings that diverge from the expected sequence.
What the report changes for defenders
BTR Reforged is a reminder that a signed security component can be both legitimate and operationally dangerous when its trust assumptions are broader than its normal user interface. The useful defensive model is a chain: who created the stream, who wrote the service values, which account loaded the driver, what the boot-time transaction changed and whether a real Defender or MRT remediation explains the sequence.
That model also keeps the severity in proportion. The report does not give an unprivileged attacker a new path to administrator rights, and it does not establish widespread real-world exploitation. It does show why an already privileged attacker may prefer a built-in, signed remediation driver and why signature-only allowlisting cannot establish benign intent. Restrict the driver-loading privilege, collect ADS and service telemetry, correlate early-boot activity and preserve evidence before cleanup when the sequence is unexplained.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
