# Windows Bind Links Enable New EDR Evasion Technique: Researchers Reveal Critical Detection Gap
Bitdefender researchers have uncovered a sophisticated evasion technique that leverages Windows bind links to hide malware from endpoint detection and response (EDR) tools, exposing a fundamental gap in how modern security solutions monitor the Windows filesystem. The attack creates conflicting filesystem views that allow threat actors to execute malicious code while concealing it from security agents, raising urgent questions about the reliability of endpoint protection in enterprise environments.
## The Threat
Security researchers at Bitdefender have published findings demonstrating that Windows bind links—a legitimate Windows feature designed for filesystem redirection—can be weaponized to evade some of the most widely deployed endpoint security solutions. By creating alternate filesystem views, attackers can place malware in locations where EDR tools cannot see or monitor them, while the operating system executes the malicious code without restriction.
The discovery highlights a critical blind spot: EDR solutions that rely on traditional filesystem monitoring may miss threats that exploit Windows' native linking mechanisms. This is particularly concerning given the prevalence of bind links in legitimate Windows configurations and the difficulty in distinguishing malicious use from benign administrative tasks.
## Technical Background: What Are Windows Bind Links?
Windows bind links are a filesystem feature introduced to support directory junctions and symbolic links. They allow administrators to create alternative paths to files and directories, enabling system flexibility and legacy application compatibility. The feature is particularly common in:
The Windows kernel maintains these redirections transparently, meaning that from an application's perspective, accessing a bind link path yields the file stored in the actual target location. This seamless redirection is by design—it's a core part of how Windows manages complex filesystem scenarios.
However, this transparency creates a security problem: if an EDR agent monitors one filesystem path while malware executes from a different path pointing to the same underlying file, the agent may never see the threat.
## How the Attack Works
The bind link evasion technique operates through several steps:
### 1. Creating the Alternate View
The attacker first establishes a bind link pointing to a directory where malware will reside. This directory can be created in a location that EDR tools monitor less rigorously—or sometimes not at all.
Original location: C:\Users\User\AppData\Local\Temp\legit.exe
Bind link created: C:\Program Files\Service\app.exe → points to Temp\legit.exe### 2. Filesystem Inconsistency
When an EDR agent queries the filesystem path using standard Windows APIs, it sees one path. However, the kernel resolves the actual file location differently. Some monitoring solutions may check only the requested path, missing the underlying actual location where the malware truly resides.
### 3. Execution with Concealment
When the malware executes through the bind link path, security tools receive API calls and process telemetry that reference the alternate path—not the actual malware location. This creates confusion in threat correlation and allows the malware to operate while appearing to come from a "clean" location.
## Implications for Enterprise Security
This vulnerability poses several critical risks to organizations relying on EDR tools:
| Impact Area | Consequence |
|---|---|
| Detection Evasion | Malware can execute undetected if EDR monitoring doesn't resolve all filesystem paths |
| Incident Response | Security teams may struggle to locate malware during forensic investigations due to conflicting filesystem views |
| Compliance | Regulatory frameworks require demonstrated endpoint monitoring; evasion gaps create compliance risk |
| Lateral Movement | Attackers could use bind links to establish persistence mechanisms that survive standard detection routines |
Organizations using EDR solutions from multiple vendors should be particularly concerned: different security tools may show conflicting information about the same compromise, complicating response efforts and potentially allowing threats to persist across remediation attempts.
The technique is especially dangerous because it requires no specialized tools or kernel-level exploits. An attacker with local administrator access—or one who has already compromised a system—can create bind links using built-in Windows commands, making the attack accessible across a wide range of threat scenarios.
## Detection and Remediation
### Detection Strategies
Organizations should implement several defensive measures:
### Remediation Steps
If bind link evasion is suspected:
1. Identify all bind links on affected systems using fsutil reparsepoint query or dir /AL commands
2. Verify the legitimacy of each link against application requirements and IT policies
3. Remove suspicious or unauthorized links
4. Scan target directories and actual file locations with offline security tools
5. Review process execution logs to identify what ran through suspicious links
6. Reimage systems where unauthorized persistence mechanisms are discovered
## Vendor Response and Patch Status
Bitdefender's disclosure prompts critical questions for the broader security industry:
Organizations should immediately contact their EDR vendors to determine vulnerability status and request proof-of-concept validation in their specific environments.
---
## HackWire Analysis
This discovery exposes a fundamental tension in endpoint security: the more Windows abstracts filesystem operations for legitimate compatibility and flexibility, the more opportunities exist for attackers to hide behind that abstraction. The bind link technique isn't a zero-day vulnerability—it's weaponized use of an existing feature—which means it could already be in the wild without detection.
What makes this particularly concerning is the pattern it represents. Over the past five years, we've seen EDR evasion mature from crude tricks (renaming executables, hiding in alternate data streams) to sophisticated attacks exploiting OS-level features that defenders were never trained to question. The NTFS alternate data streams (ADS) evasion techniques from the mid-2010s, the Windows registry transaction logs hiding, WMI event subscription persistence—each represented a layer of OS functionality that defenders had to learn and secure.
Bind links follow the same pattern: they're Windows features designed for legitimate purposes, but their transparency is a liability. An attacker with persistence on a system can use them to create long-term footholds that survive standard cleanup attempts.
The real risk is organizational. Most enterprises have security teams trained on common attack vectors—but when EDR tools themselves report conflicting information about a compromise (one path shows malware, another doesn't), the human response often defaults to trusting the tool. If an EDR solution reports "this process looks clean," security teams may fail to escalate even when the underlying malware is present.
Organizations should treat this as an urgent audit trigger: test your EDR solution against bind link evasion right now. If your vendor hasn't addressed this, treat it as a gap that needs compensating controls—enhanced filesystem auditing, periodic offline scans, behavioral monitoring independent of the EDR solution, and incident response procedures that account for conflicting detection signals.
— HackWire Editorial.
---
## Related Coverage