Operationalizing Microsoft Defender for EDR Evasion | AltSecCON 2026

BLUF: This talk demonstrates how attackers can abuse the BTR (Boot Time Removal) driver embedded inside Microsoft Defender's own engine to delete EDR/AV files and registry keys—turning Defender's legitimate functionality into an evasion tool without shipping any malicious driver 2:35-3:38.

Key Takeaways:
• Unlike traditional BYOVD attacks, the BTR driver is already present on every endpoint running Defender AV, residing inside the MPEngine.dll library—no driver needs to be brought or dropped by the attacker 2:35.
• No vulnerability is exploited; the attacker abuses legitimate APIs the boot time removal driver exposes, avoiding memory corruption, BSODs, and kernel primitives 3:43.
• Defender normally uses this driver to remove resilient malware: it extracts the driver with a randomized name, creates a service, and stores instructions in a changelist alternate data stream referenced by the driver's Args registry key 4:39-6:46.
• The configuration format includes a hardcoded magic value (0xFEE1DEAD), CRC integrity checks, and is RC4-encrypted with a key that has remained constant across driver versions, allowing anyone to craft valid transactions 8:35-10:50.
• Six action IDs support deleting files/folders, moving files, and deleting or modifying registry values—more limited than arbitrary kernel read/write, but combining file and registry operations offers substantial operational capability 11:11-12:34.
• Using start value 1 (boot bus extender) loads the BTR driver in a "golden window" after WDBoot.sys (ELAM) finishes and before WDFilter/EDR drivers load, so file and registry operations occur before EDR telemetry is active and go completely undetected 16:16-18:41.
• In the live demo, the tool deletes registry service keys for WDFilter and MsMpEng, disabling Defender after reboot, and the same technique is extended to Microsoft Defender for Endpoint and Elastic Defense by removing their agent, driver, and ELAM services 19:00-22:08.

The research, originally from Checkpoint, shows that defenders must consider attacks that abuse built-in, signed components of their own security stack rather than only externally introduced drivers.

Sources:

• 2:35 Traditional kernel access via bring-your-own vulnerable driver vs. the embedded BTR driver approach
• 3:43 No memory corruption—abuse of legitimate driver APIs
• 4:39 How Defender uses BTR to remove protected malware (extraction, service, changelist ADS)
• 8:35 Transaction format: magic header, CRC checks, RC4 encryption with persistent key