Kernel-mode deletion of Defender binaries by System process (BTR.sys)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•5

This rule detects the deletion of critical Windows Defender security files (such as drivers and executables) by the System process. This behavior is highly indicative of an attempt to tamper with or disable security features on a host.