Windows Bind Link Attacks Can Hide Malware From EDR Tools

Researchers at Bitdefender have discovered that Windows bind links can be used to create conflicting views of the filesystem, allowing malware to remain hidden from endpoint security products. This technique can potentially evade detection by endpoint detection and response tools. The discovery highlights a vulnerability in the way these tools interact with the Windows filesystem. Malware can exploit this weakness to avoid being detected. The findings suggest a limitation in the ability of endpoint security products to detect certain types of malware.