Detection rule identifying potential defense-evasion staging using Windows Boot-Time Removal driver (BTR.sys) via an NTFS alternate data stream named ":changelist" on a .sys image and a service Args registry value under HKLM\SYSTEM\*ControlSet*\Services\<name>\Args that references ":changelist". Attacker-controlled ADS and Args values can direct BTR.sys to perform kernel-level file and registry operations during early boot. The rule targets non-system writers and excludes Microsoft-signed MRT.exe running as SYSTEM to reduce false positives. It flags either: (1) file creation events where file.name ends with ":changelist"; or (2) registry change events under Services\*\Args where data contains ":changelist". The detection maps to MITRE ATT&CK techniques for defense evasion and persistence, including NTFS File Attributes (ADS), Modify Registry, Disable or Modify Tools, and Windows Service creation/modification. This supports investigation of potential staging for stealthy driver use or remediation tooling. The rule is designed for Windows endpoints and leverages process, file, and registry context to aid triage and containment.