Bitdefender Uncovers Windows Feature That Lets Attackers Blind EDR Tools Without A Vulnerable Driver

Bitdefender Labs has documented three new attack techniques that abuse a legitimate Windows file-system virtualisation feature to evade endpoint detection and response (EDR) tools, bypass built-in Windows security controls and manipulate forensic artifacts, all without modifying a single file on disk.

The feature in question is called bind links, implemented by the bindflt.sys minifilter driver that ships with modern Windows systems. It was designed for legitimate use by Store apps, Windows Sandbox and Windows containers. Bitdefender’s research demonstrates that an attacker with local administrator access can use the same feature to redirect trusted file paths to attacker-controlled files, causing security tools to inspect clean files while malicious code executes behind them.

Every Windows 10 RS4+ and Windows 11 system is exposed once an attacker has administrator access.

How bind links work

A bind link redirects a source path to a backing path. When a process opens the source path, the kernel returns the backing file instead. The caller typically has no indication that a redirection has occurred.

What makes bind links different from ordinary symbolic links is where the redirection lives. A symbolic link is an object on disk that filesystem tools can see. A bind link exists only in the memory of the bindflt.sys driver. It does not persist as a filesystem object, it does not require the source file to be deleted or modified and it disappears on reboot or when the mapping is removed.

Critically, a bind link can shadow a file that already exists. The original file remains on disk, byte for byte, while the bind link intercepts any attempt to open that path and returns a different file. Most filesystem enumeration tools will not reveal that a bind link is present.

That characteristic is what makes the feature attractive to attackers. A trusted file path can continue to look clean and legitimate while quietly serving different content to any process that opens it.

Three techniques, each building on the last

Bitdefender documented and named three distinct techniques that build on the bind link primitive, each addressing a weakness left by the previous one.

The first, called File-Binding, is path hijacking. The attacker creates a bind link from a trusted file path to an attacker-controlled file. Any process that opens the trusted path receives the attacker’s file instead. Bitdefender demonstrated this against AMSI, the Antimalware Scan Interface used by PowerShell, Windows Script Host and Office macro execution paths. By redirecting the path to amsi.dll, an attacker can cause PowerShell to load a replacement DLL that exports the same functions but scans nothing. Malicious scripts run uninspected without patching PowerShell or modifying amsi.dll on disk.

The same technique works against EDR sensor DLLs, ETW provider DLLs and forensic artifacts such as event logs. If a forensic tool opens an event log at its standard path, a bind link can return a manipulated log.

The second technique, called Process-Binding, applies File-Binding to executable images. The attacker creates a shadow bind link where the source is a trusted executable and the backing is a different executable. When the source is launched, the process that runs is backed by the attacker’s file, but parts of the process-creation telemetry still identify it as the trusted executable.

In Bitdefender’s demonstration, launching winver.exe with a bind link pointing to cmd.exe resulted in cmd.exe running while the system reported the process as winver.exe. Security controls that treat process identity as a path, including allowlisting, signature checks and firewall rules, see the trusted name rather than what is actually executing.

Process-Binding has a limitation: the link is global, meaning other tools on the system can potentially notice the inconsistency. That leads to the third and most advanced technique.

Silo-Binding creates two views of the same filesystem

Silo-Binding exploits a Windows kernel feature called silos, which are isolation boundaries used by Windows containers. A silo gives a group of processes their own view of file paths, registry entries and object names, walled off from the rest of the system.

The technique uses two bind links working in opposite directions. A silo-scoped link, active only inside the attacker’s silo, redirects the trusted path to the payload. An inverse global link, active everywhere else, redirects the payload’s path back to the clean original file.

The result is a clean split. Inside the silo, the malicious code executes. Outside the silo, every tool that inspects the process, whether an EDR re-opening the file to hash it, AppLocker checking a rule, a firewall evaluating a connection or Sysmon recording a hash, sees the clean, legitimate file.

Bitdefender demonstrated Silo-Binding bypassing AppLocker, Windows Firewall and Sysmon. In each case, the security control made its decision based on what it could see from outside the silo, which was the clean file rather than the payload actually running inside it.

Running Mimikatz past endpoint protection

To demonstrate the real-world impact, Bitdefender tested the technique against an EDR solution using Invoke-Mimikatz, a credential-stealing script that endpoint security tools reliably detect and block.

Run normally, Mimikatz was blocked the moment it executed. The researchers then ran the identical script from inside a silo where the name of a trusted Windows process, tiworker.exe, was mapped to PowerShell. The activity appeared to come from a trusted system process rather than a suspicious script. It was allowed to run. Nothing about the script changed between the two attempts. Only its apparent identity did.

Microsoft rates it low severity

Following Bitdefender’s responsible disclosure, Microsoft assessed the severity as low because the techniques require administrator access. The company’s position is that local administrator privileges represent a trust boundary that, once crossed, grants broad control over the system.

Bitdefender disagrees with that framing. The company’s position aligns with how the security industry already treats Bring Your Own Vulnerable Driver (BYOVD) attacks, which also require administrator access but are nonetheless considered a serious threat.

The research argues that administrator access should not buy an attacker a free pass on detection. Most professional ransomware groups already have EDR-killing tools in their toolkit and use them as a standard step before encryption. Those tools typically rely on BYOVD, loading a legitimately signed but vulnerable driver to blind or disable the endpoint agent from the kernel. Bind-link abuse gives attackers another way to achieve the same outcome without needing a vulnerable driver at all, only a documented Windows feature and the administrator rights they already have.

A privilege escalation path through Docker Desktop

Beyond detection evasion, Bitdefender also found and reported a privilege escalation scenario involving Docker Desktop. A member of the docker-users group, who is not a local administrator on the host, can use a bind link to escalate to SYSTEM-level access. After the disclosure, Docker updated its documentation to warn that members of docker-users can elevate to administrator on the host.

Bitdefender indicated it is confident this is not the only way bind links can be weaponised beyond detection evasion.

What bind links defeat

The research maps out the specific security controls and assumptions that bind-link abuse breaks. File-Binding defeats AMSI, EDR user-mode sensors and forensic artifact integrity. Process-Binding defeats image-path allowlisting, signature checks and policy checks. Silo-Binding defeats AppLocker, Windows Firewall, Sysmon hashing and asynchronous re-scans.

The common thread across all three techniques is that security tools trust the image-file path returned by standard process-notification routines. Bind links break that trust without modifying the trusted file, without writing into another process and without patching an EDR hook. The attacker changes file resolution and lets a trusted Windows component do the rest.

Every AV and EDR that trusts the image-file path returned by standard process-notification routines is affected. Every Sysmon deployment can be deceived, and Sysmon is now built into Windows 11 and Windows Server 2025, though not enabled by default.

Partial mitigations in Windows 24H2

Windows 24H2 introduced a veto mechanism that lets a minifilter block bind links to protected paths, but Bitdefender describes it as a partial fix rather than a complete solution. The veto is absent on older Windows versions, fires only for links on the boot partition and can be sidestepped.

Bitdefender recommends treating creation-time blocking as one layer of defence rather than a complete answer.

Guidance for security vendors

The research includes specific guidance for security vendors and detection engineers. Bitdefender recommends that vendors not trust the image path from process-creation callbacks and instead resolve the real backing file. Every path-based decision, including allowlisting, hashing, signature checks, firewall rules and data loss prevention identity rules, should be made against the resolved backing file rather than the reported path.

Vendors should also re-resolve identity on every delayed re-open, including hashing, asynchronous scanning and disinfection. The research demonstrates that reopening the same path from a different context can return a different file, meaning tools cannot assume the same path returns the same content twice.

Bitdefender recommends enumerating active bind-link mappings to catch silo-scoped links that creation-time callbacks miss and treating every filesystem virtualisation layer, not only bindflt.sys, as attacker-controlled after compromise.

Bitdefender’s own customers are already covered

Bitdefender indicated that customers running the GravityZone platform are already protected against bind-link abuse. The company’s anti-tampering protection covers this class of attack, though the company does not publish implementation details of its anti-bypass defences.

For organisations using other security platforms, Bitdefender suggests asking vendors whether they are aware of the research and how their product handles bind-link resolution, specifically whether it validates the real backing file at process creation and re-open rather than trusting the reported image path.

The research materials

The full research whitepaper and a utility called bindutil, which builds bind-link requests manually against bindflt.sys for research and defensive testing purposes, are available on Bitdefender’s official GitHub repository. The full report is available on Bitdefender’s website.

The research is part of Ctrl-Alt-DECODE, Bitdefender’s threat intelligence initiative. The company noted that many of its researchers teach at universities and publish academic research, and bring that approach to product security by studying features in depth before they are weaponised in the wild.

Last Updated on July 18, 2026 by Nick Ross