BTR.sys driver dropped/loaded by non-Defender process despite valid signature
Detects the presence or execution of the 'Boot Time Removal Tool' (BTR.sys) driver when it originates from locations outside of the legitimate Windows Defender platform or is initiated by processes not associated with the Defender ecosystem. This behavior is indicative of potential BYOVD (Bring Your Own Vulnerable Driver) attacks where attackers deploy known vulnerable drivers to gain kernel-mode privileges or interfere with security software.
Microsoft Sentinel (KQL)
