THE research analyzes the Windows Defender Boot-Time Removal driver (`BTR.sys`), revealing its potential to be exploited as a kernel operation primitive for malicious purposes. The study includes a full reverse engineering of the driver, demonstrating how it can perform arbitrary file and registry operations from Ring 0 without vulnerabilities.
The authors introduce a tool called `BTR_CLI` that facilitates this exploitation and provides capabilities for bypassing Endpoint Detection and Response (EDR) and antivirus solutions during the system boot process. Key findings include how `BTR.sys` utilizes Alternate Data Streams for configuration and feedback, making it difficult to detect abuse through traditional signature-based methods.
Recommendations for detection and mitigation focus on behavioral context, monitoring for anomalies in ADS usage, and restricting privileges associated with executing drivers. The findings ultimately emphasize the risks posed by trusted security components being repurposed for offensive capabilities.