An upgraded release of tool EDR-Redir V2, designed to evade Endpoint Detection and Response (EDR) systems by exploiting Windows bind link technology in a novel way.<\/p>\n
According to the researcher TwoSevenOneT, the version targets the parent directories of EDR installations, such as Program Files, to create redirection loops that blind security software without disrupting legitimate applications.<\/p>\n
Previously, EDR-Redir<\/a> used direct folder redirections, but protections often blocked those attempts; V2 circumvents this by looping subfolders back to themselves while isolating the EDR\u2019s path for manipulation.\u200b<\/p>\n The tool builds on Windows\u2019 bind link feature, introduced in Windows 11 24H2<\/a>, which allows filesystem namespace redirection via the bindflt.sys driver without kernel privileges.<\/p>\n EDR solutions like antivirus programs typically lock down their subfolders in locations such as Program Files or ProgramData to prevent tampering, but they cannot fully restrict writes to parent directories without breaking system installations.<\/p>\n EDR-Redir V2 queries all subfolders in the target parent, like Program Files, and mirrors them in a controlled directory, such as C:TMPTEMPDIR. It then establishes bidirectional bind links between these mirrors and originals, forming loops that maintain normal access for non-EDR software.<\/p>\n The EDR\u2019s specific subfolder, such as Windows Defender\u2019s in C:ProgramDataMicrosoft, is excluded from the loop and redirected solely to the attacker\u2019s TEMPDIR.<\/p>\n
![\"\"](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjJ8OaUa8f4ZaJUlNRJ0hS2jUidmG2bkEyCL-WdH_Z1fOAC4QnyYUaY7wgCwEdxa_GwMEC903GAFLe0hdv5ZKk7kMyhTToJFFJXdIkGyeTWA1s3l8Z4rI9PeJomG5t_oDCi-sqbmyraynLq0OSXiN03uRBk8wVoIvCNyKHwld2aFe6GOD_IWoc6hyphenhyphenNfygFW\/s16000\/EDR-Redir%2520V2%2520run%2520successfully%2520with%2520Windows%2520Defender%2520%281%29.webp?ssl=1\")
<\/figure>\n