New EDR-Redir Tool Bypasses EDRs by Exploiting Bind Filter and Cloud Filter Driver

Cybersecurity researchers have developed a tool called EDR-Redir that can bypass Endpoint Detection and Response (EDR) systems by exploiting Windows’ Bind Filter and Cloud Filter drivers, a method that operates in user mode without kernel privileges.

The researchers explain that the Windows Bind Link feature in Windows 11 version 24H2 enables virtual path mapping, and the Bind Filter driver handles this redirection transparently to applications; EDR-Redir creates virtual paths pointing to real paths under attacker control, limiting operations to OPEN and READ.

After testing against several commercial EDRs, Windows Defender proved resistant to the basic bind link approach, prompting the Cloud Filter API (CFAPI) route via the cldflt.sys driver, which researchers used to redirect a target EDR folder to an attacker-controlled path. Experiments with Elastic Defend and Sophos Intercept X showed successful folder redirection, while Cloud Filter methods produced persistent sync root folders that survive reboots, reducing the need for additional persistence techniques.

Once the attacker controls the EDR folders, they can perform DLL hijacking, place executables for EDR execution, or disable EDR processes and services; defence requires vendors to strengthen protection for installation folders and enhance monitoring[.]according to GBHackers On Security