BTR.sys Boot Time Removal Tool driver loaded outside Defender path

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•5

Detects the BTR.sys driver, a tool identified as being extracted from Microsoft's MpEngine.dll and repurposed for kernel-level file and registry manipulation. The rule matches on specific SHA-256 file hashes or combinations of PE metadata strings, indicating the presence of this driver on the system.