File system minifilter driver for Windows written in C++ to block symbolic link attacks. It monitors user-mode applications and blocks malicious attempts to set a reparse point on a directory creating a mount point to some suspicious targets like \RPC Control. See here for more information about the inner workings of the driver.
- Download the latest release or compile the driver.
- Right-click on the SymlinkProtect.inf file and click on Install.
- Open an elevated command prompt and enable test signing:
bcdedit /set testsigning on - After reboot, open an elevated command prompt again.
- Load the driver with
fltmc.exewith the load option:
fltmc load symlinkprotect - Unload the driver with
fltmc.exewith the unload option:
fltmc unload symlinkprotect
