BTR.sys ADS Configuration Stream (:changelist) on Dropped Driver

Ibrahim Saud@tektrix

•updated Sep 22, 2026•2•0•3

Detects the creation of an NTFS Alternate Data Stream named ':changelist' on files with a .sys extension. This activity is indicative of potential malicious configuration staging or persistent storage, as seen in techniques involving BTR.sys or similar driver-based persistence mechanisms.