A security researcher at Check Point has discovered that attackers with administrator-level privileges are abusing BTR.sys, a legitimate Microsoft Defender driver, to disable or weaken its security protection.

In this blog, we will explore how attackers are abusing the BTR.sys driver and what organizations can do to defend against the threat.

About BTR.sys

BTR.sys (Boot-Time Removal Driver) is a Microsoft Defender driver that is designed to remove malware that Defender cannot delete while Windows is running.

Jiří Vinopal, a Check Point researcher has discovered that attackers are repurposing this driver to achieve their own malicious objectives by disabling or weakening the security protections before they fully initialize. It is different from other remote vulnerabilities because attackers first need elevated privileges on the endpoint.

How are attackers abusing BTR.sys?

An attacker can exploit the vulnerability to:

• Disable Microsoft Defender by deleting its files and components
• Bypass tamper protection by modifying/deleting registry entries from kernel mode
• Disable EDR/endpoint security tools
• Prevent security drivers from loading
• Delete security software before it can protect the system
• Deploy malware after disabling security controls
• Facilitate ransomware attacks
• Reduce forensic visibility

SharkStriker’s recommendation

• Keep Windows and Microsoft Defender updated.
• Review and restrict SeLoadDriverPrivilege where not required.
• Monitor for unexpected modification or deletion of Defender components.
• Apply least privilege and strong controls to administrator accounts.
• Do not block or remove BTR.sys indiscriminately, as it is a legitimate Microsoft Defender component.
• Review relevant endpoint telemetry and detection coverage.
• Monitor for suspicious BTR.sys activity.
• Evaluate additional threat-hunting and detection opportunities.
• Continue monitoring Microsoft and researcher guidance.