Windows Defender Driver Weaponized for Kernel-Level Operations
Researchers have discovered that a legitimate Windows Defender driver, BTR.sys, can be repurposed by attackers to perform arbitrary file and registry operations from kernel mode, bypassing security solutions.
Security researchers at Check Point have unveiled a novel technique that allows threat actors to weaponize a legitimate component of Microsoft's own security software. The Boot-Time Removal driver (BTR.sys), part of Windows Defender, has been reverse-engineered to reveal its internal workings, including its encrypted transaction format and execution pipeline.
This deep dive into BTR.sys has enabled the creation of a tool named BTR_CLI. This tool can construct valid, encrypted transactions that instruct the Microsoft-signed driver to perform arbitrary file and registry operations directly from kernel mode (Ring 0). This bypasses the need for traditional exploits, vulnerabilities, or memory corruption techniques, making it a stealthy post-exploitation method.
The discovery originated from an incident response investigation where suspicious driver activity was traced back to legitimate Defender remediation. Initially appearing as malicious kernel loader behavior due to randomized filenames, transient service entries, and encrypted configurations, further analysis revealed it was a legitimate, albeit undocumented, remediation process.
BTR.sys is designed as a "one-shot" driver. It loads, executes a predefined list of transactions, reports its status, and then immediately unloads itself. This transient nature, combined with its kernel-level privileges, makes it a potent tool for attackers seeking to operate undetected.
The driver's configuration mechanism is particularly interesting. It doesn't use standard IOCTL interfaces. Instead, it reads a configuration blob from an Alternate Data Stream (ADS) attached to its own driver file. This blob is encrypted using an RC4 stream cipher with a hard-coded key found within the driver itself, and its integrity is protected by a modified CRC-32 check.
By leveraging BTR_CLI, attackers can craft these encrypted configurations to manipulate the file system and registry. This allows them to perform actions such as dropping malicious payloads, modifying critical system settings, or disabling security controls without triggering alerts that would typically flag unknown or unsigned kernel-mode activity. The use of a trusted, Microsoft-signed driver for these operations effectively disarms many Endpoint Detection and Response (EDR) and antivirus solutions.
This research highlights a significant concern: how defensive infrastructure, designed to protect systems, can inadvertently provide powerful primitives that attackers can exploit. The findings suggest that similar patterns might exist in other signed remediation components within operating systems and security software, warranting further investigation by defenders.
The implications for defenders are substantial. This technique, dubbed "BTR Reforged," demonstrates a sophisticated method of evading detection by co-opting trusted system components. It underscores the need for advanced monitoring techniques that can detect anomalous behavior even when executed by legitimate, signed binaries.