EDR-Redir V2: A Pioneering Tool in Evasion Tactics
An enhanced iteration of EDR-Redir V2 has emerged, engineered to circumvent Endpoint Detection and Response (EDR) systems by ingeniously leveraging Windows bind link technology.
The researcher known as TwoSevenOneT reveals that this updated version strategically focuses on the parent directories of EDR installations—such as Program Files—to orchestrate redirection loops that mislead security software while leaving legitimate applications unscathed.
In earlier versions, EDR-Redir employed direct folder redirections, a method often thwarted by existing protections. V2 innovates this approach by looping subfolders back to their original paths, effectively isolating the EDR’s trajectory for exploitation.
This tool capitalizes on the bind link feature introduced with Windows 11 24H2, which enables filesystem namespace redirection via the bindflt.sys driver, all achieved without necessitating kernel privileges.
Typically, EDR solutions, including antivirus programs, impose stringent restrictions on their subfolders located in directories like Program Files or ProgramData to thwart tampering attempts.
However, these systems find it challenging to entirely block write access to parent directories without compromising essential system installations.
EDR-Redir V2 actively queries all subfolders under the targeted parent directory, such as Program Files, and creates mirrored copies within a controlled directory, for example, C:\TMP\TEMPDIR.
It then forges bidirectional bind links between these mirrors and their originals, generating loops that ensure seamless access for software not affiliated with EDR systems.
Crucially, the specific subfolder designated for the EDR—such as Windows Defender’s located in C:\ProgramData\Microsoft—is tactically excluded from the loop, redirecting its operations solely to the attacker’s TEMPDIR.
This configuration facilitates DLL hijacking or the insertion of files into the redirected space, thereby deceiving the EDR into loading malicious components. Developers frequently neglect such parent-level redirection tactics, potentially undermining various EDR systems.
EDR-Redir V2 in Action Against Windows Defender
In a notable demonstration performed on Windows 11, TwoSevenOneT executed EDR-Redir V2 against Windows Defender, situated in C:\ProgramData\Microsoft\Windows Defender.
The execution parameters specified the target folder, redirection endpoint, and the exclusion path as follows: EDR-Redir.exe C:\ProgramData\Microsoft c:\TMP\TEMPDIR “C:\ProgramData\Microsoft\Windows Defender.”
Console output was generated, detailing the successful creation of bind links without any errors. Following the execution, Defender’s attempts to access files were diverted through TEMPDIR, effectively rendering it oblivious to its original files and facilitating potential evasion strategies.
A visualization depicted the redirection mechanism, illustrating how Defender perceived TEMPDIR as its operational parent directory. The GitHub repository hosting EDR-Redir is available for download and further experimentation. A corresponding video demonstration on YouTube elucidates the process in real time.
This methodology starkly underscores vulnerabilities present in EDRs’ defenses against filesystem manipulations at the parent directory level, thereby negating folder-specific security measures. As a result, attackers may disable EDR services or inject code while remaining undetected in user mode with minimal alerts.
Although widespread exploitation of this technique has not yet been documented, its simplicity raises alarms within enterprise landscapes. It is imperative that defenders monitor bind link utilization in critical directories such as Program Files and deploy integrity checks on EDR paths.
EDR vendors must bolster protections for parent folders without hindering usability. TwoSevenOneT is actively sharing ongoing research on X (@TwoSevenOneT) regarding penetration testing insights. As evasion tools continue to evolve, vigilant monitoring of kernel filters remains a critical necessity.
Source link: Cybersecuritynews.com.
