BTR.sys ADS config/feedback streams written to driver file (Sysmon 15)

Duo Tech@duotech

•updated Aug 21, 2026•3•1•6

Detects creation of the ':changelist' configuration stream or a feedback (*.dat) stream written onto a .sys driver file itself, distinguishing the abuse pattern (feedback stream on the driver) from legitimate Defender remediation, which writes feedback to a standalone ProgramData path.