GhostLock PoC Uses Windows API to Block File Access
Summary
Researcher Kim Dvash released GhostLock, a proof of concept that uses Windows CreateFileW and SMB sharing behavior to block file access without encrypting or deleting data. The article also describes detection telemetry and recovery conditions.
Key points
- GhostLock opens files with dwShareMode = 0, preventing other users and applications from accessing them while the handles remain open.
- The technique works on local files and SMB network shares and can be run by standard domain users without elevated privileges.
- The resulting sharing violations disrupt access but do not encrypt or delete files; access returns when the handles close, the SMB session ends, or the system reboots.
- The disruption could distract defenders while attackers conduct other activity, such as data theft or lateral movement.
- The researcher identifies per-session open-file counts with ShareAccess = 0 at the file server as a detection signal and shared SIEM queries and an NDR rule.
Article Details
- Event Type
- A security researcher released GhostLock, a proof-of-concept tool that uses Windows file-sharing behavior to block access to files.
- Impact
- GhostLock can cause temporary access disruptions to local files and files on SMB network shares by opening files exclusively, without encrypting or deleting data. Standard domain users can run it without elevated privileges. Access is restored when the relevant SMB session or processes end, or the affected system reboots. The technique could also be used as a distraction during other intrusions.