Suspicious virtual path redirection via bind filter
Detects attempts to open files or directories under security software parent paths where the calling thread's stack shows active use of the Bind Filter API (BfSetupFilter) or Cloud Filter API (CfRegisterSyncRoot) routed through a kernel DeviceIoControlFile call. This combination is the precise behavioural fingerprint of EDR redirection attacks, which enumerate and mirror subdirectories under parent directories such as Program Files or ProgramData to construct bind link loops that blind security products without disrupting other software.
- Platform: Windows
- Severity: High
- MITRE Tactic: Defense Evasion
- MITRE Techniques: T1562, T1562.001