Windows bind links can hide malware from EDR tools

Bitdefender researchers demonstrated three techniques that use Windows bind links to redirect trusted file paths to attacker-controlled files so malware can run while endpoint detection and response (EDR) tools report only the original, trusted paths. Microsoft assessed the issue as low severity because the methods require administrator privileges.

Bind links are a kernel-level Windows feature implemented by bindflt.sys. They create a virtual path that maps to a backing path on disk. Windows Store apps, Windows Sandbox and containers use the mechanism. If an attacker alters the backing path so it points to a malicious file, user-mode scanners and many EDR components can see the virtual path as valid while the system actually loads data from the attacker-controlled backing file.

The first technique, called file-binding, redirects a trusted DLL path to a crafted DLL. Many Windows components load DLLs by path and security products rely on those paths when deciding whether to scan or block a file. Bitdefender showed that redirecting a DLL path can neutralize checks such as the Antimalware Scan Interface (AMSI). Scanners that trust the reported path may not detect the malicious DLL because the virtual path matches an expected system file while the backing file supplies the attacker code.

The second technique, process-binding, applies the same idea to executable images. If a process-creation event is reported with a trusted image path, EDRs and policy engines may treat the running process as benign even when the binary image was resolved from a different backing file. Bitdefender used examples such as winver.exe to show how a product that records an image path at kernel callbacks can be misled into examining the wrong file. A limitation is that global bind links can be noticed by tools that re-open paths rather than trusting the kernel-reported name.

The third technique, silo-binding, relies on user-defined Windows silos that provide isolated filesystem and registry views for contained processes. A bind link created inside a silo is not global and is invisible to scanners outside the silo. Attackers can create two links so that inside the silo the trusted path resolves to the malicious payload, while outside the silo probes are redirected back to the original clean file. “The attacker changes file resolution and lets a trusted Windows component do the rest,” the researchers wrote. They added that “the two links describe opposite journeys for the same pair of files, and the bindflt.sys decides which one applies depending on the execution context.” Bitdefender demonstrated that silo-binding can bypass AppLocker, evade Windows Firewall rules and poison Sysmon feeds, and showed an EDR failed to detect Mimikatz when silo-binding was used.

Bitdefender disclosed the findings to Microsoft. Microsoft classified the threat as low because the techniques need administrator access. Bitdefender noted that criminal groups often obtain administrator rights during post-compromise activity and referenced common practices such as BYOVD and the use of EDR “killers.” Bind links are a supported Windows capability; the demonstrated techniques require administrator privileges and effort to create silos and redirect backing paths.