Check Point Research Warns of BTR.sys Driver Abuse for Boot-Time Security Software Deletion

Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver, BTR.sys (Boot Time Removal Tool), to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2. The technique does not exploit a software flaw and does not import any driver from outside the machine, relying instead on the legitimate signing and privileges of the BTR.sys driver.

The BTR.sys driver is a legitimate Microsoft component designed for boot-time remediation. Check Point's research demonstrates that this driver can be leveraged to perform arbitrary kernel-level operations, potentially enabling the deletion of security software at boot time. The affected systems span a wide range of Windows versions, indicating a broad impact across older and newer Windows releases.

Check Point Research has disclosed the technique; active exploitation in the wild has not been confirmed. The method enables arbitrary kernel-level file and registry operations without exploiting a software flaw. Microsoft has not released a specific patch at this time, as the driver is legitimately signed. Mitigation may involve restricting driver execution or updating security configurations, and further official Microsoft guidance is pending.