Operationalizing Microsoft Defender for EDR Evasion

Recent research unveiled Windows Defender's Boot - Time Removal driver (BTR.sys) as a kernel operation primitive. The Microsoft-signed BTR.sys driver can be coerced into executing arbitrary file and registry operations from the kernel, effectively turning a defensive capability into an offensive one. However, public proof-of-concept tools generate predictable telemetry and their execution is now rapidly flagged by modern EDR solutions.

​

This presentation bridges the gap between theoretical kernel primitives and practical, stealthy red team operationalization. We will review the foundations of the BTR.sys, its abuse and reasons why out-of-box implementations can get detected. Building on that knowledge, we'll discuss novel evasion techniques designed to bypass these detections. Attendees will learn how to safely operationalize this trusted component to disrupt EDR silently without relying on traditional BYOVD abuse.