EDR-Redir V2 can redirect entire folders like "Program Files" to point back to themselves, except for the folders of Antivirus, EDR. This means that other software continues to function normally, while only the EDR is redirected or blocked.

EDR-Redir uses a Bind Filter (mini filter bindflt.sys) and the Windows Cloud Filter API (cldflt.sys) to redirect the Endpoint Detection and Response (EDR) 's working folder to a folder of the attacker's choice. Alternatively, it can make the folder appear corrupt to prevent the EDR's process services from functioning.