BTR.sys DriverLoad followed by System PID 4 Defender file/registry deletion

Duo Tech@duotech

•updated Aug 21, 2026•6•1•12

Correlates a Sysmon DriverLoad event matching known BTR.sys hashes with a subsequent System-process (PID 4) deletion of specific Defender binaries or WdFilter/WinDefend registry keys within a 10-second window — the definitive Defender self-destruction signature of the kernel primitive.