{"id":7962,"date":"2025-10-27T10:03:26","date_gmt":"2025-10-27T10:03:26","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/10\/27\/new-edr-redir-tool-breaks-edr-exploiting-bind-filter-and-cloud-filter-driver\/"},"modified":"2025-10-27T10:03:26","modified_gmt":"2025-10-27T10:03:26","slug":"new-edr-redir-tool-breaks-edr-exploiting-bind-filter-and-cloud-filter-driver","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/10\/27\/new-edr-redir-tool-breaks-edr-exploiting-bind-filter-and-cloud-filter-driver\/","title":{"rendered":"New EDR-Redir Tool Breaks EDR Exploiting Bind Filter and Cloud Filter Driver"},"content":{"rendered":"

New EDR-Redir Tool Breaks EDR Exploiting Bind Filter and Cloud Filter Driver
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A new tool called EDR-Redir has emerged, allowing attackers to redirect or isolate the executable folders of popular Endpoint Detection and Response (EDR) solutions.<\/p>\n

Demonstrated by cybersecurity researcher TwoSevenOneT, the technique leverages Windows\u2019 Bind Filter driver (bindflt.sys) and Cloud Filter driver (cldflt.sys) to undermine EDR protections without requiring kernel-level access.<\/p>\n

This user-mode exploit, rooted in the Bring Your Own Vulnerable Driver (BYOVD<\/a>) approach, could enable attackers to disable defenses, inject malicious code, or hijack processes, leaving systems vulnerable to undetected intrusions.<\/p>\n

The vulnerability stems from Windows 11\u2019s Bind Link feature, introduced in version 24H2<\/a>. Bind Links provide filesystem namespace redirection via virtual paths, managed by the bindflt.sys minifilter driver.<\/p>\n

Unlike traditional symbolic links, which EDRs actively monitor and block using mechanisms like Microsoft\u2019s RedirectionGuard, Bind Links operate transparently at the driver level.<\/p>\n

They map virtual paths to real ones, local or remote, without creating physical files, inheriting permissions from the target while remaining invisible to most applications.<\/p>\n

This subtlety allows attackers with administrator privileges to perform read and open operations on protected EDR folders, which are typically locked against writes.<\/p>\n

EDR-Redir, available as an open-source tool on GitHub<\/a>, simplifies the process with straightforward commands. For instance, running \u201cEDR-Redir.exe bind C:TMP123 C:TMP456\u201d creates a virtual path at C:TMP123 that redirects all interactions to C:TMP456.<\/p>\n

The researcher tested<\/a> this against multiple EDRs. With Elastic Defend and Sophos Intercept X, the tool successfully redirected their executable folders to attacker-controlled locations.<\/p>\n

\"Sophos
Sophos EDR Break<\/figcaption><\/figure>\n
\n
\"Elastic
Elastic EDR<\/figcaption><\/figure>\n<\/div>\n

Once redirected, adversaries could drop DLLs for process hijacking, insert malicious executables, or empty the folder to halt EDR operations on reboot. Notably, these Bind Links do not persist across restarts, requiring a scheduled task or service for automation.<\/p>\n

Bypassing Windows Defender with Cloud Filter Tricks<\/strong><\/h2>\n

Windows Defender proved more resilient to direct Bind Link redirection, likely due to its integrated protections. However, the researcher devised a workaround using the Cloud Files API (CFAPI), powered by cldflt.sys.<\/p>\n

\"\"
Sync Fail<\/figcaption><\/figure>\n

This API, designed for sync engines like OneDrive<\/a>, enables on-demand file access through placeholder files. By invoking CfRegisterSyncRoot with minimal policies essentially an incomplete registration EDR-Redir registers the Defender folder as a \u201csync root.\u201d<\/p>\n

This corrupts access, preventing the EDR from reading or writing to its directory. Post-reboot, Defender\u2019s services fail to start, effectively isolating it.<\/p>\n

Unlike Bind Links, this Cloud Filter method persists without additional setup, making it particularly stealthy. A demo video shared by the researcher illustrates the process, showing Defender\u2019s folder becoming inaccessible after registration.<\/p>\n

Tests confirmed similar efficacy against two unnamed commercial EDRs<\/a>, highlighting a broad risk.<\/p>\n

\n
\n