BTR_CLI-style execution via documented flag combination

Duo Tech@duotech

•updated Aug 21, 2026•5•1•8

Detects process command lines matching the documented BTR_CLI.exe flag combinations (-chain/-item, -trigger now|boot, -cleanup) used to orchestrate chained kernel file/registry operations via the BTR.sys primitive.