Check Point Details Defender-Driver 'Bring Your Own Vulnerable Driver' Bypass via BTR.sys

What happened

Check Point Research disclosed a technique that abuses BTR.sys (Boot Time Removal Tool), a legitimately signed boot-time remediation driver shipped as part of Microsoft Defender, to perform arbitrary kernel-level file and registry operations. According to the report, the technique works across a wide range of Windows versions, from Windows 7 through Windows 11 25H2, does not exploit a software vulnerability in the driver, and does not require importing an external driver onto the target machine — it repurposes a trusted, already-present Microsoft component.

Why it matters

Because BTR.sys is a Microsoft-signed driver already present on Defender-enabled systems, this approach sidesteps the usual detection and blocklisting logic built around known-malicious or unsigned drivers, including protections aimed at classic Bring-Your-Own-Vulnerable-Driver (BYOVD) abuse. Kernel-level file and registry manipulation at boot time could allow an attacker with sufficient privileges to tamper with or remove security software before it fully initializes, undermining endpoint defenses on a very broad population of Windows systems. The scope described spans nearly two decades of Windows releases, which is notable for both breadth of exposure and the likelihood that remediation will need to come from Microsoft rather than individual endpoint tools.

What defenders should watch for

• Monitor for unexpected load or invocation of BTR.sys or other boot-time remediation/removal drivers outside of legitimate Defender remediation workflows.
• Watch for unexplained tampering, deletion, or disabling of security software (AV/EDR services, drivers, registry keys) around system boot, which could indicate abuse of this or similar boot-time removal mechanisms.
• Review driver-loading and kernel-callback telemetry for anomalies tied to signed Microsoft security components rather than assuming all signed-driver activity is benign.
• Track vendor guidance closely — since this abuses an intended (if narrowly scoped) capability of a legitimate driver rather than a bug, mitigation may depend on Microsoft changing how or when the driver's functionality can be invoked.

Developing story

This is newly disclosed research and details on exploitation requirements, real-world abuse, and any forthcoming Microsoft fix are still emerging. Defenders should treat the specifics as preliminary and follow updates from the original source: The Hacker News.