EDR-Redir V2 Evades Detection on Windows 11 by Faking Program Files

Security researcher TwoSevenOneT has released EDR-Redir V2, an upgraded evasion tool that exploits Windows bind link technology to bypass endpoint detection and response solutions on Windows 11. The new version uses a novel approach by redirecting through parent directories rather than targeting protected EDR folders, specifically aiming at Program Files or ProgramData.

It creates a circular bind link structure in which folders point back to themselves via an attacker-controlled temporary directory, first listing subfolders and then mirroring them in a location such as C:\TMP\TEMPDIR. The tool then establishes bind links that loop access back through the temporary directory, deliberately excluding the EDR’s folder from the loop, and in a PoC demonstration it redirected Windows Defender, which operates from C:\ProgramData\Microsoft\Windows Defender.

Running EDR-Redir with three parameters—the folder to redirect, the target location, and the exception folder—shows console output of the created bind links, confirming redirection of the security software. The researcher notes the technique could affect numerous antivirus and EDR solutions, and the tool is publicly available on GitHub, prompting concerns for organisations running Windows 11 to monitor for such bind link creation attempts targeting Program Files and ProgramData.