---
title: Potential Evasion via Boot Time Removal Tool
description: Identifies creation of a ":changelist" NTFS alternate data stream or a Windows service Args registry value pointing to a ":changelist" path. Microsoft...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_boot_time_removal_tool
products:
  - Elastic Security
---

# Potential Evasion via Boot Time Removal Tool
Identifies creation of a ":changelist" NTFS alternate data stream or a Windows service Args registry value pointing to
a ":changelist" path. Microsoft Defender's Boot-Time Removal (BTR.sys) driver reads an RC4-encrypted transaction blob
from a driver ADS named ":changelist", referenced by HKLM\SYSTEM*ControlSet*\Services*\Args. Adversaries can
reproduce this staging outside Defender to abuse BTR.sys as a signed kernel primitive for arbitrary file and registry
operations. This rule focuses on non-System writers and excludes Microsoft-signed MRT.exe running as SYSTEM, which may
perform related remediation staging.
**Rule type**: esql
**Rule indices**:
**Rule Severity**: high
**Risk Score**: 73
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/](https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/)](https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/)
- [[https://github.com/Dump-GUY/BTR_CLI](https://github.com/Dump-GUY/BTR_CLI)](https://github.com/Dump-GUY/BTR_CLI)

**Tags**:
- Domain: Endpoint
- OS: Windows
- Use Case: Threat Detection
- Tactic: Defense Evasion
- Tactic: Persistence
- Resources: Investigation Guide
- Data Source: Elastic Defend
- Rule Type: ES|QL
- Platform: Windows

**Version**: 3
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
Setup instructions: [https://ela.st/install-elastic-defend](https://ela.st/install-elastic-defend)

## Investigation guide


## Triage and analysis


### Investigating Potential Evasion via Boot Time Removal Tool

Windows Defender's Boot-Time Removal driver (`BTR.sys`) is instructed via an encrypted configuration stored in an
Alternate Data Stream named `:changelist` on a `.sys` image. The service `Args` value under
`HKLM\SYSTEM\*ControlSet*\Services\<name>\Args` points at that ADS path. Check Point Research (BTR Reforged)
showed that the same staging can be performed by non-Defender tooling (for example BTR_CLI) to drive Ring-0 file and
registry actions, including neutralization of security products during early boot.

#### Possible investigation steps

- Identify whether the alert is a file ADS creation or a service `Args` registry write using `event.category`,
  `file.name` / `file.path`, and `registry.path` / `registry.data.strings`.
- Review `process.executable`, `process.name`, `process.pid`, `process.parent.executable`, and `user.id` to determine
  whether a Defender component, MRT, or an unexpected user-mode binary staged the `:changelist` artifact.
- For file events, inspect the base `.sys` path (strip `:changelist`), size, hash, and code signature. Confirm whether
  the driver was recently dropped under a user-writable path (Downloads, Temp, Desktop) versus a Defender-managed path.
- For registry events, note the service key name under `Services\*` and check sibling values (`ImagePath`, `Type`,
  `Group`). Abuse tooling often sets `Group` to `Boot Bus Extender` and may create the service via direct registry
  writes / `NtLoadDriver` without a corresponding SCM service-install event (7045).
- Hunt on the same `host.id` for related activity: creation of `*.sys:*.dat` feedback ADS, load of a Microsoft-signed
  driver matching BTR, creation/deletion of `\\SystemRoot\\Temp\\BootClean.log` by PID 4, and deletions of security
  binaries attributed to System.
- Correlate with other alerts for the same `user.id` and `host.id` in the prior 48 hours for privilege escalation,
  driver load, or Defender tampering.


### False positive analysis

- Legitimate Defender or MRT reboot remediation may create `:changelist` ADS and related service Args values. This rule
  excludes PID 4 and Microsoft-signed `MRT.exe` as SYSTEM; unsigned or differently signed `MRT.exe` still alerts. Rare
  Defender paths (for example `MsMpEng.exe`) may still match and should be validated before exceptioning.
- Security research labs intentionally exercising BTR_CLI or similar PoCs will generate true-positive-looking events;
  confirm host cohort and change windows.


### Response and remediation

- If activity is unexplained: isolate the host, preserve the `.sys` file and `:changelist` stream, export the service
  registry key, and capture the staging process tree before cleanup.
- Search the estate for the same `file.name` / ADS pattern, service `Args` values containing `:changelist`, and related
  driver hashes.
- Remove unauthorized service keys and staged drivers, restore any deleted security components from known-good media,
  and rotate credentials for accounts that held `SeLoadDriverPrivilege` on the host.
- Restrict and monitor assignment/use of `SeLoadDriverPrivilege`; treat signed remediation drivers as LOLDrivers that
  require lineage and ADS context monitoring, not signature blocking alone.


## Rule Query

```esql
from logs-endpoint.events.file-*, logs-endpoint.events.registry-* metadata _id, _version, _index
| where host.os.type == "windows"
  and process.pid != 4
  and not (
    user.id == "S-1-5-18"
    and to_lower(process.executable) like """?:\\windows\\system32\\mrt.exe"""
    and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation") 
    and process.code_signature.trusted == true
  )
  and (
    (
      event.category == "file"
      and event.type == "creation"
      and ends_with(to_lower(file.name), ":changelist")
    )
    or (
      event.category == "registry"
      and event.type == "change"
      and to_lower(registry.path) like """*\\system\\*controlset*\\services\\*\\args"""
      and to_lower(registry.data.strings) like "*:changelist"
    )
  )
| keep
    @timestamp,
    host.id,
    host.name,
    user.id,
    user.name,
    process.pid,
    process.name,
    process.executable,
    process.code_signature.subject_name,
    event.category,
    event.type,
    file.path,
    file.name,
    file.size,
    registry.path,
    registry.value,
    registry.data.strings,
    data_stream.namespace,
    _id,
    _version,
    _index
| limit 100
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Defense Evasion
  - Id: TA0005
  - Reference URL: [[https://attack.mitre.org/tactics/TA0005/](https://attack.mitre.org/tactics/TA0005/)](https://attack.mitre.org/tactics/TA0005/)
- Technique:
  - Name: Hide Artifacts
  - Id: T1564
  - Reference URL: [[https://attack.mitre.org/techniques/T1564/](https://attack.mitre.org/techniques/T1564/)](https://attack.mitre.org/techniques/T1564/)
- Sub Technique:
  - Name: NTFS File Attributes
  - Id: T1564.004
  - Reference URL: [[https://attack.mitre.org/techniques/T1564/004/](https://attack.mitre.org/techniques/T1564/004/)](https://attack.mitre.org/techniques/T1564/004/)
- Technique:
  - Name: Modify Registry
  - Id: T1112
  - Reference URL: [[https://attack.mitre.org/techniques/T1112/](https://attack.mitre.org/techniques/T1112/)](https://attack.mitre.org/techniques/T1112/)
- Technique:
  - Name: Impair Defenses
  - Id: T1562
  - Reference URL: [[https://attack.mitre.org/techniques/T1562/](https://attack.mitre.org/techniques/T1562/)](https://attack.mitre.org/techniques/T1562/)
- Sub Technique:
  - Name: Disable or Modify Tools
  - Id: T1562.001
  - Reference URL: [[https://attack.mitre.org/techniques/T1562/001/](https://attack.mitre.org/techniques/T1562/001/)](https://attack.mitre.org/techniques/T1562/001/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Persistence
  - Id: TA0003
  - Reference URL: [[https://attack.mitre.org/tactics/TA0003/](https://attack.mitre.org/tactics/TA0003/)](https://attack.mitre.org/tactics/TA0003/)
- Technique:
  - Name: Create or Modify System Process
  - Id: T1543
  - Reference URL: [[https://attack.mitre.org/techniques/T1543/](https://attack.mitre.org/techniques/T1543/)](https://attack.mitre.org/techniques/T1543/)
- Sub Technique:
  - Name: Windows Service
  - Id: T1543.003
  - Reference URL: [[https://attack.mitre.org/techniques/T1543/003/](https://attack.mitre.org/techniques/T1543/003/)](https://attack.mitre.org/techniques/T1543/003/)