Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point Research has disclosed a technique that uses Microsoft Defender's own boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems. The driver, BTR.sys, is a required Windows component that cannot be added to M…
Intelligence analysis by Llama
Check Point Research has found a technique that uses Microsoft Defender's own driver to delete security software at boot. The driver, BTR.sys, is a required Windows component that can be used to perform arbitrary kernel-level file and registry operations. This technique has not been used in real-world attacks, but it could be used by threat actors in the future.
Imagine you have a special tool that can delete files and registry entries on your computer. This tool is called BTR.sys and it's used by Microsoft Defender to fix problems on your computer. But what if someone were to use this tool to delete security software and gain control of your computer? That's what Check Point Research has discovered, and it's a big deal because it shows that a built-in Windows driver can be used as a kernel offensive primitive.
Analysis
BTR.sys: A Required Windows Component
BTR.sys is a required Windows component that is used by Microsoft Defender to perform boot-time remediation. It is a legitimate driver that is embedded in Defender's MpEngine.dll as the BOOTTIMETOOL resource. The driver is deployed when Defender must finish removing malware after a reboot, deleting files or registry entries that were locked while Windows was running.
Reverse-Engineering BTR.sys
Jiří Vinopal, a threat researcher and reverse engineer at Check Point Research, reverse-engineered the driver's proprietary, undocumented transaction protocol and found that every configuration blob passed to BTR.sys is RC4-encrypted with a 256-byte key hard-coded in the .rdata section of every BTR.sys build shipped since Windows 7. This means that the driver is not vulnerable to traditional driver exploitation techniques.
BTR_CLI: A Proof-of-Concept Tool
Check Point Research created a proof-of-concept tool called BTR_CLI that can be used to demonstrate the technique. The tool locates MpEngine.dll under Defender's Definition Updates and extracts the embedded BTR.sys binary. It then constructs a valid encrypted transaction and installs the driver as a service via direct HKLM registry writes. When loaded, BTR.sys executes the queued operations from Ring 0, attributed in telemetry to the System process (PID 4).
Implications
The use of a built-in Windows driver as a kernel offensive primitive is significant because it shows that threat actors may be able to use this technique to delete security software and gain control of a system. The driver is not vulnerable to traditional driver exploitation techniques, but it can still be used to perform arbitrary kernel-level file and registry operations. This means that system administrators and security professionals need to be aware of this technique and take steps to prevent it from being used in real-world attacks.
Key points
- Check Point Research has disclosed a technique that uses Microsoft Defender's own boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems.
- The driver, BTR.sys, is a required Windows component that cannot be added to Microsoft's Vulnerable Driver Blocklist or blocked via Windows Defender Application Control without disrupting Defender itself.
- The technique has not been used in real-world attacks, but it could be used by threat actors in the future.
- The use of a built-in Windows driver as a kernel offensive primitive is significant because it shows that threat actors may be able to use this technique to delete security software and gain control of a system.
The discovery of this technique by Check Point Research may lead to the development of new security measures to prevent it from being used in real-world attacks. This could include the creation of new drivers that are not vulnerable to this technique, or the development of new security software that can detect and prevent the use of BTR.sys.
The use of a built-in Windows driver as a kernel offensive primitive could lead to a new wave of attacks that are difficult to detect and prevent. This could result in significant security risks for individuals and organizations, and could potentially lead to the compromise of sensitive data.
