[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fR5vcn0zklQw0oINZEEeNxjqqo-ZNjIAoWR9k9EfO4V4":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"549c6b22-0124-43d5-b1ad-2bd05a413732","Windows Bind Link Attacks Can Hide Malware From EDR Tools","windows-bind-link-attacks-can-hide-malware-from-edr-tools-dc1a9b","Bitdefender researchers show how Windows bind links can create conflicting filesystem views to hide malware from endpoint security products. The post Windows Bind Link Attacks Can Hide Malware From EDR Tools appeared first on SecurityWeek.","Bitdefender security researchers have disclosed three attack techniques exploiting Windows bind links—a legitimate kernel-level redirection feature—to evade endpoint detection and response (EDR) products. The attacks manipulate bind links to create conflicting filesystem views, allowing attackers to load hidden malware while EDR tools see trusted, benign file paths. Microsoft assessed the findings as low severity due to requiring admin access, though Bitdefender notes that attackers frequently obtain administrator privileges.","Bitdefender researchers demonstrate Windows bind link attacks that hide malware from EDR tools.","https:\u002F\u002Fwww.securityweek.com\u002Fwindows-bind-link-attacks-can-hide-malware-from-edr-tools\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F10\u002FWindows-Kernel-BSOD.jpg","2026-07-15T13:00:00+00:00","2026-07-15T14:00:32.717083+00:00",8,[17,20,22,25,28,30],{"name":18,"type":19},"Bitdefender","vendor",{"name":21,"type":19},"Microsoft",{"name":23,"type":24},"Windows","product",{"name":26,"type":27},"bind links (bindflt.sys)","technology",{"name":29,"type":24},"AMSI (Antimalware Scan Interface)",{"name":31,"type":24},"PowerShell","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[],[21,18,23],{"controls":46,"vendors":123},[47,75,95],{"slug":48,"name":49,"problem":50,"products":51},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":48,"product_name":72,"url":73,"description":74},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":76,"name":77,"problem":78,"products":79},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[80,87],{"vendor_slug":81,"vendor_name":21,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":117,"vendor_name":18,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[124,127],{"slug":117,"name":18,"logo_path":118,"roles":125},[126],"reported_by",{"slug":81,"name":21,"logo_path":82,"roles":128},[129],"affected",{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":145},"windows-bind-links-weaponized-to-blind-edr-tools","Windows Bind Links Weaponized to Blind EDR Tools","Attackers are exploiting a legitimate Windows kernel feature—bind links—to create conflicting filesystem views that trick EDR tools into seeing benign file paths while malicious code executes underneath. The root issue lies in EDR solutions trusting kernel-level path resolutions without validating the underlying filesystem reality, creating a blind spot that sophisticated attackers can abuse. While Microsoft rates this as low severity due to the admin-access prerequisite, this underestimates real-world risk because attackers routinely escalate to or phish their way into admin credentials. This technique highlights that even trusted OS-native features can be weaponized as evasion mechanisms, undermining the assumption that EDR telemetry is always accurate. Organizations relying solely on EDR for detection without layered controls face a meaningful gap in their defense posture.",[135,136,137,138,139,140,141,142,143,144],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 8 – Audit Log Management","CIS Control 10 – Malware Defenses","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 AU-12 – Audit Record Generation","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SI-7 – Software, Firmware, and Information Integrity","MITRE ATT&CK T1564 – Hide Artifacts","MITRE ATT&CK T1548 – Abuse Elevation Control Mechanism","ITIL – Continual Service Improvement (Security Control Validation)",{}]