GhostTree Uses Recursive NTFS Junctions to Evade Folder Scans
Summary
Varonis describes GhostTree, which uses branching NTFS junction loops to create vast recursive paths that can hang Windows and EDR folder scans, leaving malware unexamined. The article says Microsoft was notified and later patched the issue.
Key points
- The article says any user with write access can create NTFS junctions without administrator privileges.
- GhostBranch points a child junction back to its parent; GhostTree adds multiple looping child folders to multiply possible paths.
- Recursive scans may hang before examining malicious files in the parent folder; Varonis reports testing the technique against Windows Defender.
- The article says the traditional 260-character path limit constrains depth, while branching can produce an estimated 2^126 possible paths in its example.
- Varonis says it reported the issue to Microsoft; Microsoft initially said the behavior did not cross a security boundary, and the issue was later patched.
Article Details
- Attack Vectors
- A user with write access to a folder can create NTFS junctions without administrator privileges, pointing a child directory back to its parent.
- GhostTree creates multiple looping child junctions, producing many recursive paths. The article reports that recursive directory scans, including EDR scans, can hang while malicious files in the parent folder remain unexamined.
- The technique was tested against Windows Defender, where the article reports it could evade folder scans.
- Defensive Notes
- The issue was reported to Microsoft and was subsequently patched.
- Monitor file-system activity for anomalous junction creation and recursive directory structures.
- Use layered defenses rather than relying on endpoint scanning alone.