Potential Evasion via Boot Time Removal Tool

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Potential Evasion via Boot Time Removal Tool

Identifies creation of a ":changelist" NTFS alternate data stream or a Windows service Args registry value pointing to a ":changelist" path. Microsoft Defender’s Boot-Time Removal (BTR.sys) driver reads an RC4-encrypted transaction blob from a driver ADS named ":changelist", referenced by HKLM\SYSTEM*ControlSet*\Services\*\Args. Adversaries can reproduce this staging outside Defender to abuse BTR.sys as a signed kernel primitive for arbitrary file and registry operations. This rule focuses on non-System writers and excludes Microsoft-signed MRT.exe running as SYSTEM, which may perform related remediation staging.

Rule type: esql

Rule indices: None

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
OS: Windows
Use Case: Threat Detection
Tactic: Defense Evasion
Tactic: Persistence
Resources: Investigation Guide
Data Source: Elastic Defend

Version: 2

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Potential Evasion via Boot Time Removal Tool

Windows Defender’s Boot-Time Removal driver (BTR.sys) is instructed via an encrypted configuration stored in an Alternate Data Stream named :changelist on a .sys image. The service Args value under HKLM\SYSTEM\*ControlSet*\Services\<name>\Args points at that ADS path. Check Point Research (BTR Reforged) showed that the same staging can be performed by non-Defender tooling (for example BTR_CLI) to drive Ring-0 file and registry actions, including neutralization of security products during early boot.

Possible investigation steps

Identify whether the alert is a file ADS creation or a service Args registry write using event.category, file.name / file.path, and registry.path / registry.data.strings.
Review process.executable, process.name, process.pid, process.parent.executable, and user.id to determine whether a Defender component, MRT, or an unexpected user-mode binary staged the :changelist artifact.
For file events, inspect the base .sys path (strip :changelist), size, hash, and code signature. Confirm whether the driver was recently dropped under a user-writable path (Downloads, Temp, Desktop) versus a Defender-managed path.
For registry events, note the service key name under Services\* and check sibling values (ImagePath, Type, Group). Abuse tooling often sets Group to Boot Bus Extender and may create the service via direct registry writes / NtLoadDriver without a corresponding SCM service-install event (7045).
Hunt on the same host.id for related activity: creation of *.sys:*.dat feedback ADS, load of a Microsoft-signed driver matching BTR, creation/deletion of \SystemRoot\Temp\BootClean.log by PID 4, and deletions of security binaries attributed to System.
Correlate with other alerts for the same user.id and host.id in the prior 48 hours for privilege escalation, driver load, or Defender tampering.

False positive analysis

Legitimate Defender or MRT reboot remediation may create :changelist ADS and related service Args values. This rule excludes PID 4 and Microsoft-signed MRT.exe as SYSTEM; unsigned or differently signed MRT.exe still alerts. Rare Defender paths (for example MsMpEng.exe) may still match and should be validated before exceptioning.
Security research labs intentionally exercising BTR_CLI or similar PoCs will generate true-positive-looking events; confirm host cohort and change windows.

Response and remediation

If activity is unexplained: isolate the host, preserve the .sys file and :changelist stream, export the service registry key, and capture the staging process tree before cleanup.
Search the estate for the same file.name / ADS pattern, service Args values containing :changelist, and related driver hashes.
Remove unauthorized service keys and staged drivers, restore any deleted security components from known-good media, and rotate credentials for accounts that held SeLoadDriverPrivilege on the host.
Restrict and monitor assignment/use of SeLoadDriverPrivilege; treat signed remediation drivers as LOLDrivers that require lineage and ADS context monitoring, not signature blocking alone.

Setup

edit

Setup

This rule is designed for data generated by Elastic Defend, which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

Rule query

edit

from logs-endpoint.events.file-*, logs-endpoint.events.registry-* metadata _id, _version, _index
| where host.os.type == "windows"
  and process.pid != 4
  and not (
    user.id == "S-1-5-18"
    and to_lower(process.executable) like """?:\\windows\\system32\\mrt.exe"""
    and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation")
    and process.code_signature.trusted == true
  )
  and (
    (
      event.category == "file"
      and event.type == "creation"
      and ends_with(to_lower(file.name), ":changelist")
    )
    or (
      event.category == "registry"
      and event.type == "change"
      and to_lower(registry.path) like """*\\system\\*controlset*\\services\\*\\args"""
      and to_lower(registry.data.strings) like "*:changelist"
    )
  )
| keep
    @timestamp,
    host.id,
    host.name,
    user.id,
    user.name,
    process.pid,
    process.name,
    process.executable,
    process.code_signature.subject_name,
    event.category,
    event.type,
    file.path,
    file.name,
    file.size,
    registry.path,
    registry.value,
    registry.data.strings,
    data_stream.namespace,
    _id,
    _version,
    _index
| limit 100

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Hide Artifacts
- ID: T1564
- Reference URL: https://attack.mitre.org/techniques/T1564/
Sub-technique:
- Name: NTFS File Attributes
- ID: T1564.004
- Reference URL: https://attack.mitre.org/techniques/T1564/004/
Technique:
- Name: Modify Registry
- ID: T1112
- Reference URL: https://attack.mitre.org/techniques/T1112/
Technique:
- Name: Impair Defenses
- ID: T1562
- Reference URL: https://attack.mitre.org/techniques/T1562/
Sub-technique:
- Name: Disable or Modify Tools
- ID: T1562.001
- Reference URL: https://attack.mitre.org/techniques/T1562/001/
Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Create or Modify System Process
- ID: T1543
- Reference URL: https://attack.mitre.org/techniques/T1543/
Sub-technique:
- Name: Windows Service
- ID: T1543.003
- Reference URL: https://attack.mitre.org/techniques/T1543/003/

« Potential Etherhiding C2 via Blockchain Connection Potential Evasion via Filter Manager »