BTR.sys extracted driver dropped and loaded from non-standard path

Duo Tech@duotech

•updated Aug 21, 2026•5•1•8

Detects a randomly-named 8-character .sys file created outside standard driver/staging paths and then loaded from a non-standard user or temp directory shortly after — matching the pattern of BTR.sys being extracted from MpEngine.dll's embedded resource and executed outside its normal location.