Suspicious BindFilterPort Client Process

[rule]
description = """
Identifies attempts to load send IOCTL requests directly to the Bind Filter Port device from an unusual client process.
This may indicate the presence of folder redirection functionality using the bind link feature of Windows.
"""
id = "67a459a1-6d86-4002-adc3-a6e1249a7d2e"
license = "Elastic License v2"
name = "Suspicious BindFilterPort Client Process"
os_list = ["windows"]
reference = [
    "https://www.zerosalarium.com/2025/10/DR-Redir-Break-EDR-Via-BindLink-Cloud-Filter.html",
    "https://learn.microsoft.com/en-us/windows/win32/bindlink/",
]
version = "1.0.2"

query = '''
api where
 process.Ext.api.name == "DeviceIoControl" and
 process.Ext.api.parameters.device like "\\Device\\BindFltPort" and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $caller,
                  $caller.trusted == true and $caller.subject_name in ("Microsoft Windows Publisher", "Microsoft Corporation", "Microsoft Windows"))
'''

min_endpoint_version = "8.14.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.0"