BTR_CLI Action 3 move/write of driver into System32\drivers

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects the execution of BTR_CLI.exe with command line arguments indicative of installing or interacting with the Mimikatz driver (mimidrv.sys). This behavior is associated with loading the malicious driver to facilitate credential dumping from kernel memory.