BindFltApi Loaded by an Unusual Process

[rule]
description = """
Identifies attempts to load the BindFltApi module by an unusual process. This may indicate the presence of folder
redirection functionality using the bind link feature of Windows.
"""
id = "167be4b9-c953-4610-860e-4c5cde709683"
license = "Elastic License v2"
name = "BindFltApi Loaded by an Unusual Process"
os_list = ["windows"]
reference = [
    "https://www.zerosalarium.com/2025/10/DR-Redir-Break-EDR-Via-BindLink-Cloud-Filter.html",
    "https://learn.microsoft.com/en-us/windows/win32/bindlink/",
]
version = "1.0.3"

query = '''
library where (dll.name : ("bindfltapi.dll", "bindflt.dll") or dll.pe.original_file_name in ("BindFltApi.dll", "BindFlt.dll")) and
 user.id != null and process.executable != null and process.thread.Ext.call_stack_summary != null and 
 not (user.id == "S-1-5-18" and
      process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Windows Publisher", "Microsoft Corporation", "Beijing Qihu Technology Co., Ltd.") and
      process.code_signature.trusted == true)
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"