Check Point Research threat researcher Jiří Vinopal presented BTR Reforged at Black Hat USA 2026 and DEF CON 34, disclosing a technique that uses Defender’s own legitimately signed boot-time remediation driver — BTR.sys — to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2, with no software vulnerability exploited and no third-party driver needed. BTR.sys is embedded in Defender’s MpEngine.dll and exists on every Windows installation: it is meant to delete malware files that are locked while Windows is running by finishing the removal job at the next boot, before most security services have started. Vinopal reverse-engineered the driver’s undocumented transaction protocol and found that every configuration blob is RC4-encrypted with a 256-byte key hard-coded in every BTR.sys build since Windows 7, unchanged across 18 verified versions.
The resulting proof-of-concept tool, BTR_CLI, extracts BTR.sys directly from Defender’s own definition update files, constructs a valid encrypted transaction, and installs the driver as a boot service via direct registry writes — bypassing the Service Control Manager and producing no Windows Event ID 7045 (Service Installed) log entry. At boot, the driver runs in the “golden window” after the filesystem becomes writable but before Defender’s user-mode services start, allowing it to physically remove security binaries — including WdFilter.sys and MsMpEng.exe — before they can lock themselves. A live demonstration at Black Hat deleted the entire Defender stack from a fully updated Windows 11 25H2 system with Tamper Protection active. The technique requires an administrator account with SeLoadDriverPrivilege. Unlike typical bring-your-own-vulnerable-driver attacks, BTR.sys is a built-in Windows component that cannot be added to Defender’s Vulnerable Driver Blocklist without breaking Defender itself. Microsoft confirmed the technique does not meet criteria for an immediate fix because it requires pre-existing administrative privileges; no patch is currently planned.