Windows defenders are facing a new way for attackers to hide activity after gaining administrator access.
The technique abuses Windows bind links, a legitimate feature that redirects one file path to another without changing the original file on disk.
Rather than dropping a visible replacement file or modifying security software, an attacker can make a trusted path quietly return malicious content.
This creates a gap between what a process runs and what endpoint tools believe they are inspecting.
Bitdefender said in a report shared with Cyber Security News (CSN) that the issue affects modern Windows systems once an attacker has local administrator privileges.
Researchers said the technique can weaken endpoint detection, application controls, logging, and scanning mechanisms that trust a file path as a reliable identity.
.webp)
The research does not describe a standalone malware family or a mass exploitation campaign. Instead, it details a post-compromise evasion method that could give ransomware operators and other intruders another route to reduce visibility after taking control of a Windows device.
Windows Bind Link Abuse
Bind links are handled by the Windows Bind Filter driver and are commonly used for virtualization features, including Windows containers and Sandbox environments.
Unlike a symbolic link, a bind link is stored in memory rather than as a visible file-system object, making normal file enumeration far less useful for spotting it.
The method can also shadow a file that already exists. A signed, clean program can remain untouched on disk, while processes that open its path receive a different attacker-controlled file through the filter layer. This distinction is central to the researchers’ File-Binding technique.
With File-Binding, a threat actor can redirect a trusted DLL path to a replacement library that exposes the expected functions but does not perform security checks.
In one demonstration, the approach caused PowerShell to load a fake AMSI component, allowing scripts to appear clean without patching the real Windows file.
That same principle could affect user-mode EDR sensors, event-tracing components, and forensic tools that reopen files later for analysis.
.webp)
It builds on concerns raised in earlier reporting about Windows MiniFilter EDR bypass, where kernel file-system components were also shown to create opportunities for disrupting endpoint visibility.
The second technique, Process-Binding, applies the redirection to an executable image. Windows can report the trusted source path during process creation even though a different backing executable supplies the code that actually runs.
This can undermine path-based allowlisting, signature validation, and security dashboards that rely on the reported image name. Security teams have previously tracked low privileged EDR bypass techniques that use masquerading and deceptive paths, but bind links shift the deception into Windows file resolution itself.
Silo-Binding Extends Evasion
Silo-Binding is the most advanced variant described in the research. It uses a Windows silo, an isolation boundary behind containers and sandboxed environments, to make the same path resolve differently inside and outside the isolated process group.
Inside the silo, a trusted-looking executable path can lead to malicious code.
Outside it, an EDR platform, forensic utility, or administrator inspecting the same path can be redirected back to the legitimate file, creating a convincing but false view of the system.
This split can affect AppLocker, Windows Firewall, Sysmon hashing, and delayed scanning workflows.
The finding is particularly notable alongside a recent Microsoft AppLocker policy flaw, which likewise showed how application-control assumptions can leave room for unauthorized execution.
.webp)
Sysmon may record the trusted program name and the hash of the clean file instead of the code that executed in the silo.
Investigators searching for a known malicious hash could therefore find no matching events, while logs still appear normal.
The report recommends that security vendors resolve the real backing file instead of trusting process-creation paths alone.
They should repeat that validation during delayed hashing, scanning, and remediation operations, and enumerate active bind-link mappings to identify silo-scoped redirections.
Organizations should also ask endpoint security providers whether their products validate backing-file identity at launch and during later file checks.
Teams can strengthen investigation practices by correlating process activity with container or silo creation, unusual administrative actions, and other signs of defense evasion, including PowerShell log bypass methods.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post Windows Bind Link Abuse Lets Attackers Blind EDR and Bypass AMSI, AppLocker, and Sysmon appeared first on Cyber Security News.