Executive Summary
Check Point Research has detailed the weaponization of the Windows Defender Boot-Time Removal driver (BTR.sys), a legitimate Microsoft-signed component used for malware remediation. By reverse-engineering its proprietary transaction format, researchers demonstrated that the driver can be manipulated to execute arbitrary file and registry operations with kernel-level privileges without requiring an exploit or memory corruption. The driver uses a hard-coded 256-byte RC4 key for its configuration blob, which has remained consistent across Windows versions for over 15 years.
The attack leverages a "Golden Window" during the Phase 1 boot process (SERVICE_SYSTEM_START). By staging BTR.sys as a 'Boot Bus Extender' service, it can execute after the filesystem is initialized but before the full security stack and user-mode EDR services are active. This allows for the physical deletion of security binaries (e.g., MsMpEng.exe) and the removal of registry tamper protection keys. Because BTR.sys is an essential, built-in component, it is not currently blocked by the Microsoft Vulnerable Driver Blocklist, making it a highly effective 'Living-off-the-Land' driver (LOLDriver).
While the report mentions Handala Hack in the source metadata, the technical analysis focuses on the universal utility of the BTR_CLI tool for red-teaming and defense validation. MSRC has acknowledged the findings but noted they do not meet the criteria for immediate servicing as the technique requires existing SeLoadDriverPrivilege.