TLDR Tech / InfoSec
Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR
Bitdefender Labs documented three escalating post-compromise techniques abusing the bindflt.sys minifilter driver: File-Binding hijacks trusted DLL and artifact paths (defeating AMSI, EDR sensors, and forensic tools), Process-Binding redirects a trusted executable to a different backing image, and Silo-Binding scopes bind links to a Windows container silo so malicious code runs inside while AppLocker, Windows Firewall, and Sysmon see a clean file outside it, letting Invoke-Mimikatz run undetected in testing. The chain requires local administrator access, mirrors BYOVD in threat model, and maps to MITRE ATT&CK T1562.001, T1574.001/002, T1036.005, T1055-adjacent behavior, T1070.001, and T1003.002, plus a novel Docker Desktop docker-users-to-SYSTEM escalation path. Defenders should stop trusting image paths from process-creation callbacks, resolve the real backing file via IoGetShadowFileInformation or PsReferenceProcessFilePointer, re-resolve identity on every delayed re-open, enumerate active bind-link mappings, and confirm with their EDR/AV vendor whether bind-link resolution is validated rather than relying solely on Windows 24H2's partial veto protection.
Read the full story