Microsoft Defender BTR.sys reverse engineering shows a signed boot-time driver can be used for kernel-level file and registry operations
Technical Analysis
Summary
Hide ▲
Show ▼
BTR.sys has been shown to function as a kernel-level file and registry operation primitive on Windows 7 through Windows 11 25H2, creating a new hardening and detection problem for Microsoft Defender deployments. The proof-of-concept BTR_CLI pulls the embedded driver from MpEngine.dll and submits a valid encrypted transaction to trigger boot-time operations. The technique does not require a software flaw or an external driver, but it does require administrator access and SeLoadDriverPrivilege. Researchers reported no evidence of real-world abuse and published Sysmon and Windows event patterns for defenders.
Related Happenings
HoneyMyte PlugX campaign targeting Myanmar
Campaign
H score32
First: 14.08.2026 16:08
Last: 14.08.2026 16:08
Sources 1
About this happening:
The HoneyMyte campaign targeting Myanmar now uses PlugX to deploy CoolClient and persistence steps that make post-compromise access harder to detect. The activity...
HoneyMyte PlugX campaign targeting Myanmar
CampaignAbout this happening: The HoneyMyte campaign targeting Myanmar now uses PlugX to deploy CoolClient and persistence steps that make post-compromise access harder to detect. The activity...
Windows Plug and Play auto-install abuse reaches SYSTEM code execution on Windows 11
Technical Analysis
H score26
First: 11.08.2026 13:48
Last: 11.08.2026 13:48
Sources 1
About this happening:
Researchers showed that Windows Plug and Play auto-install can be abused to reach SYSTEM code execution on Windows 11, turning a privileged device-install path into a...
Windows Plug and Play auto-install abuse reaches SYSTEM code execution on Windows 11
Technical AnalysisAbout this happening: Researchers showed that Windows Plug and Play auto-install can be abused to reach SYSTEM code execution on Windows 11, turning a privileged device-install path into a...
Apple A12/S4/S5/A13 BootROM usbliter8 authentication bypass flaw
Vulnerability
H score27
First: 22.06.2026 17:00
Last: 22.06.2026 17:00
Sources 1
About this happening:
Researchers disclosed usbliter8, an unpatchable BootROM flaw affecting Apple A12, S4/S5, and A13 SoCs, creating boot-chain compromise risk for devices with physical...
Apple A12/S4/S5/A13 BootROM usbliter8 authentication bypass flaw
VulnerabilityAbout this happening: Researchers disclosed usbliter8, an unpatchable BootROM flaw affecting Apple A12, S4/S5, and A13 SoCs, creating boot-chain compromise risk for devices with physical...
Microsoft Defender zero-days exploited in attacks (multiple vulnerabilities)
Vulnerability
H score39
First: 21.05.2026 10:49
Last: 21.05.2026 10:49
Sources 1
About this happening:
Microsoft began rolling out fixes for CVE-2026-41091 and CVE-2026-45498, two actively exploited zero-days in Microsoft Defender components that affect unpatched Wi...
Microsoft Defender zero-days exploited in attacks (multiple vulnerabilities)
VulnerabilityAbout this happening: Microsoft began rolling out fixes for CVE-2026-41091 and CVE-2026-45498, two actively exploited zero-days in Microsoft Defender components that affect unpatched Wi...
Windows BitLocker YellowKey security feature bypass (CVE-2026-45585)
Vulnerability
H score9
First: 20.05.2026 11:28
Last: 20.05.2026 11:28
Sources 1
About this happening:
CVE-2026-45585 (YellowKey) is a BitLocker security feature bypass affecting Windows 11 24H2/25H2/26H1 and Windows Server 2025, including Server Core. Microsoft disclosed the issue...
Windows BitLocker YellowKey security feature bypass (CVE-2026-45585)
VulnerabilityAbout this happening: CVE-2026-45585 (YellowKey) is a BitLocker security feature bypass affecting Windows 11 24H2/25H2/26H1 and Windows Server 2025, including Server Core. Microsoft disclosed the issue...
Latest development: 11.06.2026 20:43
Security researcher Chaotic Eclipse released GreatXML, a Windows BitLocker bypass that copies unattend.xml and Recovery/WindowsRE/ReAgent.xml onto the recovery partition and then boots into Windows Recovery Environment (WinRE) to spawn a shell with unrestricted access to the BitLocker volume. The researcher said the flaw could automatically affect systems that ever used Windows Defender Offline Scan, and the release followed YellowKey (CVE-2026-45585), which Microsoft patched in Patch Tuesday updates.
Timeline
-
21.08.2026 18:52 2 articles · 3h ago
Check Point Research reveals BTR.sys kernel-level file and registry operations
Initial DisclosureCheck Point Research publicly presents and publishes findings showing that Microsoft Defender's signed BTR.sys boot-time remediation driver can be repurposed to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting a software flaw or importing an external driver. Jiří Vinopal presents the work at Black Hat USA 2026 and DEF CON 34 in Las Vegas, releases the BTR_CLI proof-of-concept, and documents that the technique relies on administrator access with SeLoadDriverPrivilege while recommending detection monitoring and privilege restriction.
Show sources
- Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot — thehackernews.com — 21.08.2026 18:52
- Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot — thehackernews.com — 21.08.2026 18:52