Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR

Bitdefender researchers provided an in-depth analysis of a little-known Windows mechanism — Bind Links, implemented by bindflt.sys. Windows uses this driver in Windows Sandbox, containers, and UWP applications to virtualize the file system, but with local administrator privileges, it can be also used to bypass security controls.

The authors described three techniques: • File-Binding — replacing the contents of a trusted path (for example, amsi.dll or an EDR agent DLL), causing a process to load a malicious file while security tools continue to see the original. • Process-Binding — launching a malicious executable under the guise of a trusted process, undermining mechanisms that rely on checking the path, signature, or image hash. • Silo-Binding — the most interesting technique, exploiting the separation between two views of the same file system. Inside an isolated container, a process that appears trusted executes attacker-controlled code. Outside it, every tool inspecting the process sees a clean, legitimate file.

The research is significant because it demonstrates the abuse of a native Windows mechanism that violates a basic assumption underlying many security tools: the same path always points to the same file. AppLocker, AMSI, Sysmon, various EDR products, and other security controls base their checks on this assumption.

Microsoft assessed the risk as low, since the attack requires local administrator privileges. However, Bitdefender notes that modern ransomware groups typically obtain such privileges during the early stages of a compromise, making Bind Links another tool for covertly executing follow-on actions without using vulnerable drivers.

Article: https://www.bitdefender.com/en-us/blog/businessinsights/bind-link-abuses-windows-feature-edr-evasion-technique

PoC (full research and the bindutil utility): https://github.com/bitdefender/bindutil-toolset