Bypass Record
BYOVD (Vulnerable Driver) × Microsoft Defender
A publicly-reported instance of BYOVD (Vulnerable Driver) bypassing Microsoft Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
BTR.sys is a signed Microsoft driver used by Defender during boot-time remediation to delete malicious files and registry entries. An attacker with admin rights can load this driver and invoke its IOCTLs to delete or modify files/registry keys, including those belonging to EDR/AV products, effectively disabling them. The driver does not validate the caller's intent, allowing abuse of its powerful deletion capabilities.
Detection & mitigation
Monitor for loading of BTR.sys outside of expected boot-time context, especially by non-system processes. Use endpoint telemetry to detect unusual driver load events and correlate with subsequent file/registry deletions targeting security product components. Enforce application control policies to block loading of unnecessary drivers.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.