BTR.sys kernel-mode deletion of Defender WdFilter/WinDefend service keys

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•7

Detects rapid deletion of Windows Defender or WdFilter service registry keys by non-standard processes (not System or ntoskrnl.exe). This pattern is consistent with kernel-mode tamper protection bypass attempts, such as the use of the BTR.sys driver to force the removal of defensive configuration entries, effectively disabling Windows Defender.