New GhostTree Attack Causes EDR Tools to Hang, Leaving Files Unscanned

A newly disclosed attack technique dubbed “GhostTree” is raising concerns among defenders after researchers demonstrated how it can disrupt endpoint detection and response (EDR) tools and bypass file scanning mechanisms on Windows systems.

The technique, discovered by Varonis Threat Labs, abuses NTFS junctions to create recursive directory structures that can cause security tools to hang indefinitely.

New GhostTree Attack

NTFS junctions are a legitimate Windows file system feature that allows one directory to point to another, similar to a shortcut but treated as a real folder by the operating system.

Importantly, creating junctions does not require administrative privileges, any user with write access can generate them using a simple command such as:

mklink /J C:\Link C:\Target

While typically used for compatibility or storage management, attackers can weaponize this feature by creating loops.

By pointing a child directory back to its parent, a recursive structure is formed, allowing the same files to be accessed through an unlimited number of paths.

The research outlines two variations of the attack:

• GhostBranch: A single junction loops back to the parent directory, generating multiple valid paths to the same file. For example, a file can be accessed via increasingly nested paths, such as C:\Parent\Child\Child\Program.exe.
• GhostTree: A more advanced variant that creates multiple junctions (e.g., Child1 and Child2), forming a branching structure. Each level in the path can branch in different directions, exponentially increasing the number of possible paths.

This branching effect allows attackers to generate an enormous number of unique directory paths pointing to the same malicious file.

Windows traditionally enforces a maximum path length of 260 characters, which limits the depth of recursion. However, within this constraint, GhostTree can still produce a massive number of valid paths.

• GhostBranch creates a linear set of paths.
• GhostTree creates a combinatorial explosion, with theoretical possibilities reaching 21262126 paths, an astronomically large number.

This “path explosion” creates a significant problem for EDR tools and antivirus scanners that rely on recursive directory traversal. When scanning such a structure, the tool may continuously follow new paths without termination, effectively hanging the scan process.

As a result, malicious files placed in the affected directory may remain unscanned and undetected.

Varonis researchers confirmed that the technique could interfere with Microsoft Defender’s scanning capabilities, demonstrating practical evasion potential. Although initially classified as not crossing a security boundary, the issue has since been addressed with a patch.

Detection and Mitigation Strategies

GhostTree highlights a broader limitation of traditional endpoint scanning approaches. Security teams should consider layered defenses, including:

• Monitoring for abnormal junction or symbolic link creation activity
• Detecting recursive or circular directory structures
• Implementing behavioral analysis at the file system level
• Limiting unnecessary write permissions in sensitive directories

The GhostTree technique underscores how overlooked operating system features can be repurposed for evasion. By exploiting recursive path structures, attackers can effectively blind security tools without needing elevated privileges.

This reinforces the need for visibility beyond signature-based scanning and toward behavior-driven detection.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.