BindFltApi Loaded by an Unusual Process


Description

Identifies attempts to load the BindFltApi module by an unusual process. This may indicate the presence of folder redirection functionality using the bind link feature of Windows.

Query · eql

library where (dll.name : ("bindfltapi.dll", "bindflt.dll") or dll.pe.original_file_name in ("BindFltApi.dll", "BindFlt.dll")) and
 user.id != null and process.executable != null and process.thread.Ext.call_stack_summary != null and 
 not (user.id == "S-1-5-18" and
      process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Windows Publisher", "Microsoft Corporation", "Beijing Qihu Technology Co., Ltd.") and
      process.code_signature.trusted == true)
Raw source BindFltApi Loaded by an Unusual Process · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified.
[rule]
description = """
Identifies attempts to load the BindFltApi module by an unusual process. This may indicate the presence of folder
redirection functionality using the bind link feature of Windows.
"""
id = "167be4b9-c953-4610-860e-4c5cde709683"
license = "Elastic License v2"
name = "BindFltApi Loaded by an Unusual Process"
os_list = ["windows"]
reference = [
    "https://www.zerosalarium.com/2025/10/DR-Redir-Break-EDR-Via-BindLink-Cloud-Filter.html",
    "https://learn.microsoft.com/en-us/windows/win32/bindlink/",
]
version = "1.0.3"

query = '''
library where (dll.name : ("bindfltapi.dll", "bindflt.dll") or dll.pe.original_file_name in ("BindFltApi.dll", "BindFlt.dll")) and
 user.id != null and process.executable != null and process.thread.Ext.call_stack_summary != null and 
 not (user.id == "S-1-5-18" and
      process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Windows Publisher", "Microsoft Corporation", "Beijing Qihu Technology Co., Ltd.") and
      process.code_signature.trusted == true)
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.