BTR.sys BootClean.log lifecycle correlated with anomalous driver load

Duo Tech@duotech

•updated Aug 21, 2026•2•0•12

Correlates the hardcoded BootClean.log creation-then-deletion lifecycle (performed by the System process) with a preceding anomalous or hash-matched BTR.sys driver load within a tight time window, reducing the otherwise high false-positive rate of alerting on the log artifact alone.