BTR.sys

Tool

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

August 20, 2026

Last Seen

August 21, 2026

Overview

Recent Events

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (1)

Abuse of Microsoft Defender Driver Enables Kernel-Level Attacks

Aug 20·10 sources

Related Articles (2)

Microsoft Defender’s signed BTR.sys driver can erase security tools at boot

Feeds.4Sysops·Aug 21

Microsoft Defender Driver Can Be Weaponized to Disable EDR and AV From Windows Kernel

Cybersecuritynews·Aug 20

Related Entities

Microsoft Defender Windows Windows 11 25H2 Windows 7 Boot-Time Removal (BTR.sys) Driver