Potential Evasion via Boot Time Removal Tool

  1[metadata]
  2creation_date = "2026/08/21"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/08/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies creation of a ":changelist" NTFS alternate data stream or a Windows service Args registry value pointing to
 11a ":changelist" path. Microsoft Defender's Boot-Time Removal (BTR.sys) driver reads an RC4-encrypted transaction blob
 12from a driver ADS named ":changelist", referenced by HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\Args. Adversaries can
 13reproduce this staging outside Defender to abuse BTR.sys as a signed kernel primitive for arbitrary file and registry
 14operations. This rule focuses on non-System writers and excludes Microsoft-signed MRT.exe running as SYSTEM, which may
 15perform related remediation staging.
 16"""
 17from = "now-9m"
 18language = "esql"
 19license = "Elastic License v2"
 20name = "Potential Evasion via Boot Time Removal Tool"
 21note = """## Triage and analysis
 22
 23### Investigating Potential Evasion via Boot Time Removal Tool
 24
 25Windows Defender's Boot-Time Removal driver (`BTR.sys`) is instructed via an encrypted configuration stored in an
 26Alternate Data Stream named `:changelist` on a `.sys` image. The service `Args` value under
 27`HKLM\\SYSTEM\\*ControlSet*\\Services\\<name>\\Args` points at that ADS path. Check Point Research (BTR Reforged)
 28showed that the same staging can be performed by non-Defender tooling (for example BTR_CLI) to drive Ring-0 file and
 29registry actions, including neutralization of security products during early boot.
 30
 31#### Possible investigation steps
 32
 33- Identify whether the alert is a file ADS creation or a service `Args` registry write using `event.category`,
 34  `file.name` / `file.path`, and `registry.path` / `registry.data.strings`.
 35- Review `process.executable`, `process.name`, `process.pid`, `process.parent.executable`, and `user.id` to determine
 36  whether a Defender component, MRT, or an unexpected user-mode binary staged the `:changelist` artifact.
 37- For file events, inspect the base `.sys` path (strip `:changelist`), size, hash, and code signature. Confirm whether
 38  the driver was recently dropped under a user-writable path (Downloads, Temp, Desktop) versus a Defender-managed path.
 39- For registry events, note the service key name under `Services\\*` and check sibling values (`ImagePath`, `Type`,
 40  `Group`). Abuse tooling often sets `Group` to `Boot Bus Extender` and may create the service via direct registry
 41  writes / `NtLoadDriver` without a corresponding SCM service-install event (7045).
 42- Hunt on the same `host.id` for related activity: creation of `*.sys:*.dat` feedback ADS, load of a Microsoft-signed
 43  driver matching BTR, creation/deletion of `\\\\SystemRoot\\\\Temp\\\\BootClean.log` by PID 4, and deletions of security
 44  binaries attributed to System.
 45- Correlate with other alerts for the same `user.id` and `host.id` in the prior 48 hours for privilege escalation,
 46  driver load, or Defender tampering.
 47
 48### False positive analysis
 49
 50- Legitimate Defender or MRT reboot remediation may create `:changelist` ADS and related service Args values. This rule
 51  excludes PID 4 and Microsoft-signed `MRT.exe` as SYSTEM; unsigned or differently signed `MRT.exe` still alerts. Rare
 52  Defender paths (for example `MsMpEng.exe`) may still match and should be validated before exceptioning.
 53- Security research labs intentionally exercising BTR_CLI or similar PoCs will generate true-positive-looking events;
 54  confirm host cohort and change windows.
 55
 56### Response and remediation
 57
 58- If activity is unexplained: isolate the host, preserve the `.sys` file and `:changelist` stream, export the service
 59  registry key, and capture the staging process tree before cleanup.
 60- Search the estate for the same `file.name` / ADS pattern, service `Args` values containing `:changelist`, and related
 61  driver hashes.
 62- Remove unauthorized service keys and staged drivers, restore any deleted security components from known-good media,
 63  and rotate credentials for accounts that held `SeLoadDriverPrivilege` on the host.
 64- Restrict and monitor assignment/use of `SeLoadDriverPrivilege`; treat signed remediation drivers as LOLDrivers that
 65  require lineage and ADS context monitoring, not signature blocking alone.
 66"""
 67
 68setup = """## Setup
 69
 70This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 71
 72Setup instructions: https://ela.st/install-elastic-defend
 73"""
 74
 75references = [
 76    "https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/",
 77    "https://github.com/Dump-GUY/BTR_CLI",
 78]
 79risk_score = 73
 80rule_id = "942c8f59-f01c-4dc0-a05f-2f5bba836ad8"
 81severity = "high"
 82tags = [
 83    "Domain: Endpoint",
 84    "OS: Windows",
 85    "Use Case: Threat Detection",
 86    "Tactic: Defense Evasion",
 87    "Tactic: Persistence",
 88    "Resources: Investigation Guide",
 89    "Data Source: Elastic Defend",
 90]
 91timestamp_override = "event.ingested"
 92type = "esql"
 93
 94query = '''
 95from logs-endpoint.events.file-*, logs-endpoint.events.registry-* metadata _id, _version, _index
 96| where host.os.type == "windows"
 97  and process.pid != 4
 98  and not (
 99    user.id == "S-1-5-18"
100    and to_lower(process.executable) like """?:\\windows\\system32\\mrt.exe"""
101    and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation") 
102    and process.code_signature.trusted == true
103  )
104  and (
105    (
106      event.category == "file"
107      and event.type == "creation"
108      and ends_with(to_lower(file.name), ":changelist")
109    )
110    or (
111      event.category == "registry"
112      and event.type == "change"
113      and to_lower(registry.path) like """*\\system\\*controlset*\\services\\*\\args"""
114      and to_lower(registry.data.strings) like "*:changelist"
115    )
116  )
117| keep
118    @timestamp,
119    host.id,
120    host.name,
121    user.id,
122    user.name,
123    process.pid,
124    process.name,
125    process.executable,
126    process.code_signature.subject_name,
127    event.category,
128    event.type,
129    file.path,
130    file.name,
131    file.size,
132    registry.path,
133    registry.value,
134    registry.data.strings,
135    data_stream.namespace,
136    _id,
137    _version,
138    _index
139| limit 100
140'''
141
142[rule.investigation_fields]
143field_names = [
144    "@timestamp",
145    "host.id",
146    "host.name",
147    "user.id",
148    "user.name",
149    "process.pid",
150    "process.name",
151    "process.executable",
152    "process.code_signature.subject_name",
153    "event.category",
154    "file.path",
155    "file.name",
156    "file.size",
157    "registry.path",
158    "registry.value",
159    "registry.data.strings",
160]
161
162[[rule.threat]]
163framework = "MITRE ATT&CK"
164
165[[rule.threat.technique]]
166id = "T1564"
167name = "Hide Artifacts"
168reference = "https://attack.mitre.org/techniques/T1564/"
169
170[[rule.threat.technique.subtechnique]]
171id = "T1564.004"
172name = "NTFS File Attributes"
173reference = "https://attack.mitre.org/techniques/T1564/004/"
174
175[[rule.threat.technique]]
176id = "T1112"
177name = "Modify Registry"
178reference = "https://attack.mitre.org/techniques/T1112/"
179
180[[rule.threat.technique]]
181id = "T1562"
182name = "Impair Defenses"
183reference = "https://attack.mitre.org/techniques/T1562/"
184
185[[rule.threat.technique.subtechnique]]
186id = "T1562.001"
187name = "Disable or Modify Tools"
188reference = "https://attack.mitre.org/techniques/T1562/001/"
189
190[rule.threat.tactic]
191id = "TA0005"
192name = "Defense Evasion"
193reference = "https://attack.mitre.org/tactics/TA0005/"
194
195[[rule.threat]]
196framework = "MITRE ATT&CK"
197
198[[rule.threat.technique]]
199id = "T1543"
200name = "Create or Modify System Process"
201reference = "https://attack.mitre.org/techniques/T1543/"
202
203[[rule.threat.technique.subtechnique]]
204id = "T1543.003"
205name = "Windows Service"
206reference = "https://attack.mitre.org/techniques/T1543/003/"
207
208[rule.threat.tactic]
209id = "TA0003"
210name = "Persistence"
211reference = "https://attack.mitre.org/tactics/TA0003/"