Bitdefender Details Windows Bind-Link Techniques That Can Evade EDR
Summary
Bitdefender researchers describe three Windows bind-link techniques that can hide attacker-controlled files from EDR tools, including silo-binding. Microsoft rated the findings low severity because they require administrator access.
Key points
- File-binding redirects a trusted path to an attacker-controlled file; researchers describe using it to evade AMSI scanning.
- Process-binding redirects an executable image path so an EDR may inspect a harmless file instead of the attacker’s instructions.
- Silo-binding uses isolated filesystem views and opposing bind links to make malware visible inside a Windows silo but appear clean to scanners outside it.
- Researchers say silo-binding can subvert AppLocker and Windows Firewall and poison Sysmon.
- In Bitdefender’s test, EDR detected standard Mimikatz without silo-binding but did not detect it when the technique was used.
- The techniques require administrator-level access; Microsoft assessed the findings as low severity.
Article Details
- Attack Vectors
- File-binding redirects a trusted DLL path to an attacker-controlled DLL, which the researchers say can evade AMSI scanning.
- Process-binding redirects an executable path so an EDR may inspect a harmless file such as winver.exe while the attacker’s instructions remain hidden.
- Silo-binding uses a user-defined Windows silo and opposing bind links to present a payload inside the silo and a clean file to scanners outside it; the researchers demonstrated this against EDR detection of Mimikatz.
- The described techniques require administrator-level access; the article says silo-binding also requires creating a user-defined Windows silo.
- Defensive Notes
- Microsoft assessed the findings as low severity because they require administrator access; Bitdefender argued that attackers may already have those privileges.
- The researchers note that global bind links used in process-binding may be detected by scanners or EDR components that reopen paths; silo-binding is intended to prevent outside scanners from seeing the silo’s filesystem view.
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationWith process-binding, the EDR may see a trusted executable path such as winver.exe and inspect a harmless file while the attacker’s instructions remain hidden.T1562.001 · Disable or Modify ToolsThe researchers describe bind-link redirection that can neutralize AMSI scanning and evade EDR detection.
Vendors
BitdefenderSecurity researchers at Bitdefender have demonstrated three attack techniques in which Windows’ bind links can be used to evade endpoint detection and response (EDR) products.MicrosoftIt should be said that Microsoft assessed Bitdefender’s findings as low severity since it requires admin access. Bitdefender’s response is that criminals regularly obtain administrator access.
Products
AppLockerThey give examples of how silo-binding can subvert built-in Windows security defenses: AppLocker bypass, Windows Firewall bypass, and Sysmon poisoning.Microsoft WindowsSecurity researchers at Bitdefender have demonstrated three attack techniques in which Windows’ bind links can be used to evade endpoint detection and response (EDR) products.PowerShellPowerShell is one of the Windows apps that invokes AMSI to check its script (others include Windows Script Host, the JavaScript and VBScript engines, and Office macro execution paths).Windows FirewallThey give examples of how silo-binding can subvert built-in Windows security defenses: AppLocker bypass, Windows Firewall bypass, and Sysmon poisoning.Windows SysmonThey give examples of how silo-binding can subvert built-in Windows security defenses: AppLocker bypass, Windows Firewall bypass, and Sysmon poisoning.