BTR.sys LOLDriver Abuse for Boot-Time Security Software Removal

Technical Analysis

The technique leverages BTR.sys (Boot Time Removal Tool), a legitimately signed Windows Defender driver designed for boot-time remediation, to execute arbitrary kernel-mode file and registry operations without exploiting a software vulnerability or importing an untrusted driver — making it a 'living-off-the-land driver' (LOLDriver) style attack that evades signature-based and behavioral defenses. An attacker with sufficient privileges could weaponize BTR.sys to disable or delete EDR/AV agents and other security tooling before the OS fully boots, undermining detection and response capabilities. No CVE has been assigned as this abuses intended driver functionality rather than a coding flaw, though Microsoft may issue mitigations such as driver blocklisting or hardened signing policies. Organizations running AI agent infrastructure on Windows hosts should treat this as agent-relevant: hosts running LLM orchestration, RAG pipelines, or agent tool-execution services often rely on endpoint security agents for isolation and monitoring, and boot-time removal of these protections could allow follow-on compromise, credential theft (including API keys and service tokens used by agents), or persistence undetected by security telemetry.

Affected Systems

Windows 7 through Windows 11 25H2 (all versions where the Microsoft Defender BTR.sys boot-time remediation driver is present); systems relying on Defender or third-party AV/EDR agents for endpoint protection

Indicators of Compromise

• BTR.sys (Boot Time Removal Tool driver)
• No public hashes, IPs, or domains disclosed at time of reporting

Remediation Steps

1. 1

   Monitor for anomalous driver usage

   Deploy detection rules for unauthorized invocation or manipulation of BTR.sys outside legitimate Defender remediation workflows.

2. 2

   Apply vendor guidance/patches

   Track Microsoft's response and apply any driver blocklist updates, HVCI/driver signing policy changes, or Defender updates addressing this abuse vector.

3. 3

   Harden boot and driver load policies

   Enable Windows Defender Application Control (WDAC), Hypervisor-Protected Code Integrity (HVCI), and Secure Boot with driver allowlisting to limit which drivers can execute at boot.

4. 4

   Restrict administrative privileges

   Limit local admin/SYSTEM-level access, since exploitation likely requires elevated privileges to load or trigger the driver's remediation functions.

5. 5

   Protect agent host integrity

   For hosts running AI agent frameworks or orchestration services, ensure endpoint security telemetry is forwarded to an independent, tamper-resistant logging system to detect boot-time tampering even if local security software is disabled.