Critical Windows Vulnerability Blinds EDR, Bypasses AMSI, AppLocker, Sysmon

Key Takeaways

• A newly discovered evasion technique abuses Windows bind links, a legitimate OS feature, to hide malicious activity.
• Attackers with local administrator privileges can use this method to bypass Endpoint Detection and Response (EDR) solutions, AMSI, AppLocker, and Sysmon.
• The technique works by redirecting trusted file paths to malicious content without altering the original files on disk, effectively blinding security tools.
• This is a post-compromise evasion method, not a standalone malware, offering threat actors a new way to maintain stealth after initial system access.
• Microsoft has not issued a specific patch for this behavior as it leverages a legitimate Windows feature.

Cybersecurity defenders are confronting a sophisticated new method allowing attackers to conceal their actions on Windows systems once administrative access has been achieved. This technique exploits Windows bind links, a native operating system feature designed to redirect one file path to another without modifying the underlying file on the disk itself.

Instead of deploying a visible malicious file or directly tampering with security software, an attacker can leverage bind links to make a seemingly legitimate file path deliver malicious content. This creates a critical discrepancy between what a process executes and what endpoint security tools perceive they are monitoring and inspecting. As Bitdefender said in a report, this vulnerability impacts contemporary Windows environments, contingent on the attacker first obtaining local administrator privileges. Researchers highlighted that this technique can severely degrade the efficacy of endpoint detection, application control, logging, and scanning mechanisms that rely on file paths as a trustworthy identifier.

It’s important to note that this research does not describe a novel malware family or a widespread exploitation campaign. Rather, it details a potent post-compromise evasion tactic. This method could provide ransomware groups and other malicious actors with an additional avenue to diminish their visibility within a compromised Windows environment after establishing control.

Windows Bind Link Abuse

Windows bind links are managed by the Windows Bind Filter driver and are integral to virtualization capabilities, including Windows containers and Sandbox environments. Unlike symbolic links, bind links reside in memory rather than as discernible file-system objects, rendering traditional file enumeration techniques largely ineffective for detecting them.

The technique enables the shadowing of an existing file. A signed, legitimate program can remain undisturbed on the disk, while any process attempting to access its path is surreptitiously served a different, attacker-controlled file via the bind filter layer. This fundamental distinction underpins the researchers’ “File-Binding” technique.

Through File-Binding, a threat actor can reroute a trusted DLL path to a substitute library. This malicious library is engineered to expose the expected functions while deliberately circumventing security checks. In a practical demonstration, this approach successfully tricked PowerShell into loading a counterfeit AMSI (Antimalware Scan Interface) component. This allowed malicious scripts to execute undetected, appearing benign without requiring any direct modification to the genuine Windows AMSI file.

This same principle can extend its impact to user-mode EDR sensors, event-tracing components, and forensic tools that might later re-examine files for analysis. The findings echo concerns previously raised regarding Windows MiniFilter EDR bypasses, where kernel file-system components were also shown to create avenues for undermining endpoint visibility.

Process-Binding

The second technique, known as Process-Binding, extends this redirection to an executable image. In this scenario, Windows may report the original, trusted source path during process creation, even though a completely different backing executable is providing the code that is actually running. This can severely compromise path-based allowlisting, signature validation, and security dashboards that depend on the reported image name for accuracy. While security teams have previously addressed low-privileged EDR bypass techniques involving masquerading and deceptive paths, bind links introduce a new layer of deception directly within Windows’ native file resolution mechanism.

Silo-Binding Extends Evasion

Silo-Binding represents the most advanced variant detailed in the research. It leverages a Windows silo, an isolation boundary fundamental to containers and sandboxed environments, to ensure that the same file path resolves differently both inside and outside the isolated process group.

Within the silo, a path that appears to point to a trusted executable can, in reality, lead to malicious code. Conversely, an EDR platform, a forensic utility, or an administrator inspecting the identical path from outside the silo would be redirected back to the legitimate file. This creates a highly convincing, yet entirely false, impression of system integrity.

This sophisticated split in file resolution can bypass critical security mechanisms such as AppLocker, Windows Firewall, Sysmon hashing, and delayed scanning workflows. This discovery is particularly significant when considered alongside a recent Microsoft AppLocker policy flaw, which similarly demonstrated how flawed assumptions in application control policies can create opportunities for unauthorized code execution.

For instance, Sysmon might log the trusted program name and the hash of the clean file, rather than the malicious code that actually executed within the silo. Consequently, investigators searching for a known malicious hash might find no corresponding events, while system logs appear entirely normal, masking the true nature of the activity.

What You Should Do

• Verify Backing Files: Security vendors should enhance their products to resolve the actual backing file rather than solely relying on reported process-creation paths.
• Continuous Validation: Implement repeated validation of backing file identity during delayed hashing, scanning, and remediation operations to catch post-execution changes.
• Enumerate Bind Links: Develop capabilities to enumerate active bind-link mappings to identify silo-scoped redirections and other stealthy manipulations.
• Query EDR Providers: Organizations should actively inquire with their endpoint security providers about whether their products validate backing-file identity at process launch and during subsequent file checks.
• Strengthen Investigation Practices: Improve incident response by correlating process activity with container or silo creation events, unusual administrative actions, and other indicators of defense evasion, including known PowerShell log bypass methods.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.