Black Hat USA 2026: Check Point Demonstrates Disabling Defender with Microsoft's Built-in BTR.sys

Check Point disclosed a no-CVE attack technique at Black Hat USA 2026: abuse Microsoft Defender's legitimately signed boot-remediation driver BTR.sys to delete arbitrary security software—including Defender itself—at Ring 0 on Windows 7 through 11 25H2. No patch, no CVE. WDAC and vulnerable-driver blocklists cannot intercept it. PoC tool BTR_CLI is public.

Check Point Research disclosed a high-severity Windows Defender evasion technique at Black Hat USA 2026 and DEF CON in parallel. An attacker can abuse Defender's own legitimately signed boot-remediation driver `BTR.sys` to delete arbitrary files and registry keys at Ring 0 on Windows 7, Windows 10, and Windows 11 25H2—including Defender itself. No CVE. No patch. WDAC (Windows Defender Application Control) and vulnerable-driver blocklists cannot intercept it directly. PoC tool `BTR_CLI` shipped with the research paper.

Incident Overview

`BTR.sys` is the Boot-Time Remediation Driver, a legitimate Microsoft Defender component. Designed to complete security-software repair and rollback early in boot. Microsoft-signed, shipped with Defender, required—cannot simply be blocked. Researchers found `BTR.sys` loads earlier than most user-mode security products and implements an undocumented RC4-encrypted transaction protocol. An attacker only needs to register a fake service key whose Args value contains `:changelist`. On the next reboot, `BTR.sys` deletes arbitrary files and registry keys in kernel mode as instructed. The entire sequence runs before Defender itself initializes—a natural golden window.

Technical Details

`BTR.sys` is an early-load driver in the Boot Bus Extender group. Boot-stage load precedes initialization of most security products. Abusing its RC4 transaction protocol yields arbitrary file and registry deletion at Ring 0.

Attack steps from the research:

• Register a fake service key under `HKLM\SYSTEM\CurrentControlSet\Services` with an Args value carrying the `:changelist` marker
• Wait for reboot. `BTR.sys` loads at boot and parses that service key's Args value
• `BTR.sys` deletes arbitrary files and registry keys in kernel mode per instruction
• After reboot, Defender and registered AV/EDR products are gone. Attacker has an unprotected system

Check Point live demo: a fully patched machine with Defender full-stack protection. After reboot, the entire Defender stack was cleanly removed. Unlike typical BYOVD (Bring Your Own Vulnerable Driver), the abused driver is not a third-party vulnerable driver. It is a Microsoft-signed, built-in, required Defender component. Signature-trust defenses are natively ineffective.

Impact Assessment

CVSS: N/A (no CVE). Attack vector: local; requires administrator. Attack complexity: low. Privileges required: administrator. User interaction: yes (reboot). PoC status: yes (`BTR_CLI` published). Known in-the-wild: no abuse observed yet; post-publication exploit barrier is very low. Impact surface: Windows 7, Windows 10, Windows 11 25H2—nearly all desktop and server endpoints, especially enterprises that rely on Defender as the primary control.

Affected Scope and Versions

• Windows 7, Windows 10, Windows 11 through 25H2
• Trigger: attacker already has local administrator and can force a reboot
• Prerequisite: `BTR.sys` ships with Defender; cannot be uninstalled

Remediation

This technique does not depend on a specific vulnerability. Traditional patching and version upgrades do not mitigate it. Rely on detection and behavioral control:

• Detect `BTR.sys` load behavior: Sysmon Event ID 6 (Driver Load). Flag `BTR.sys` instances loaded by non-Defender processes (PowerShell, cmd, unsigned tools)
• Monitor suspicious service-key creation: Sysmon Event ID 13 (Registry Value Create/Modify) or Windows Security logs. Watch new service keys under `HKLM\SYSTEM\CurrentControlSet\Services` whose Args field contains `:changelist`
• Monitor boot-stage security-product deletion: unexpected loss of Defender, third-party EDR, or AV executables after reboot must alert immediately
• Block `BTR_CLI` spread: EDR, file reputation, and application-control policy against known `BTR_CLI` hashes
• Enable ASR (Attack Surface Reduction) rules and Controlled Folder Access on endpoints. Combine Script Block Logging and PowerShell Constrained Language Mode. Reduce the chance of reaching the boot-stage control path
• HIDS file-integrity monitoring on Defender and security-product binary directories. Baseline alerts
• Add boot-stage manipulation detections to the IR playbook. Pre-stage scripts that rapidly restore Defender and the security-product stack

Detection Rules

• Sysmon Event ID 6: alert if `BTR.sys` is loaded by a non-Defender process
• Sysmon Event ID 13: alert on writes to Services subkey Args values matching `:changelist`
• Windows Security log: Defender service start failure; related executable scheduled-task failure
• EDR process monitoring: known `BTR_CLI` hashes
• Sysmon Event ID 11 (FileCreate): unexpected writes into Defender or EDR install directories

Enterprises that rely on Defender as the sole endpoint control should immediately evaluate third-party EDR/XDR coverage and close the `BTR.sys` abuse detection gap with a Sysmon + SIEM rule chain. Do not depend on a single signature-trust mechanism.

References

• AJ King: Cyber Threat Brief August 23 2026
• HackersRadar: Critical Azure and Entra ID Flaws
• Cybersecurity Institute: Security Operations Weekly August 23 2026