The GhostTree technique highlights an important weakness in security architectures that depend too heavily on recursive file scanning. Researchers demonstrated that attackers could abuse legitimate Windows NTFS junctions to create looping and branching directory structures, causing endpoint security tools to follow an enormous number of valid file paths while malicious files in the same location remain unexamined. 

NTFS junctions are reparse points that allow one directory to redirect to another. They are commonly used for compatibility, storage management, and application redirection. GhostTree weaponizes this legitimate feature by creating junctions that point back to their parent directory, producing recursive paths that appear valid to Windows and to applications traversing the file system. Crucially, creating such junctions does not require administrator privileges. A user only needs write access to the relevant directory. 

The simpler variant, called GhostBranch, creates one recursive path. GhostTree extends the idea by creating multiple branches at every level. With two possible folder names and a depth of approximately 126 levels under traditional Windows path limits, researchers calculated that the structure could theoretically produce around 2^126 possible path combinations. The files are not duplicated billions of times; the same underlying content is exposed through a vast number of valid-looking paths. Computers, having finally encountered bureaucracy at machine speed, may spend effectively forever trying to inspect all of them. 

When an antivirus or EDR product performs a recursive folder scan, it may continue following these junctions instead of recognising and terminating the loop. The scan can hang or fail to complete, leaving executable files placed alongside the junction structure unscanned. Varonis tested the technique against Microsoft Defender and confirmed that it could interfere with folder scanning. The researchers reported the issue to Microsoft, and although it was initially described as not crossing a security boundary, Microsoft subsequently patched the behaviour. 

It is important to understand what GhostTree is and what it is not. It is primarily a defence-evasion technique, not necessarily an initial-access vulnerability or a direct privilege-escalation method. An attacker would generally need some ability to write files and create junctions on the target system before using GhostTree. However, once that access exists, the technique may help conceal malware from directory-based inspection and complicate incident response.

This distinction does not make the issue harmless. Many attacks begin with limited user-level access obtained through phishing, stolen credentials, malicious downloads, compromised software, or exploitation of an application. A technique that requires no administrator rights can then help the attacker preserve malicious files, delay discovery, or interfere with routine security scans while pursuing credential theft, persistence, lateral movement, or data exfiltration.

The incident also shows the limitations of treating a successful antivirus scan as proof that a system is clean. Security products must safely handle junctions, symbolic links, reparse points, deeply nested paths, archives, mounted file systems, and other structures that can create recursion or resource exhaustion. A scan that hangs silently is especially dangerous because administrators may assume that the inspection is still running or has completed normally.

For customers, the immediate priority should be to ensure that Windows systems, Microsoft Defender components, and third-party endpoint security products are fully updated. Organizations should verify with their EDR vendors that recursive NTFS junction handling is protected against loops and branching path structures. Since Microsoft patched the reported behaviour but the precise implementation and coverage of third-party products may differ, customers should not assume that every endpoint tool is automatically protected. 

Security teams should also monitor the creation and modification of NTFS junctions and other reparse points, particularly in user-writable directories, temporary folders, download locations, shared drives, application-data folders, and software deployment paths. Junction creation may be legitimate, so detection should focus on suspicious patterns such as multiple junctions pointing to a parent directory, rapid creation of branching structures, repeated recursive traversal errors, or junctions created immediately before malware execution.

Endpoint controls should generate alerts when scans repeatedly time out, consume abnormal CPU or memory, remain incomplete, or encounter excessive path recursion. Scan failures and skipped directories must be treated as security events rather than routine operational noise. An attacker does not need to defeat every detection engine if they can simply persuade one of them to wander through an endless directory maze.

Organizations should restrict write permissions in sensitive locations and prevent ordinary users from modifying directories used for application installation, software distribution, security tools, scripts, and system services. Application allowlisting can further reduce the impact by preventing unknown executables from running even when they have not been successfully scanned.

Behavioural monitoring remains critical. Even where a malicious file evades a folder scan, its execution may still generate detectable activity, including suspicious child processes, credential access, registry changes, persistence creation, command execution, unusual PowerShell activity, connections to external infrastructure, and attempts to access sensitive data. Endpoint telemetry should therefore be correlated with identity, DNS, firewall, proxy, server, and data-access logs.

Network-layer security provides an additional line of defence when endpoint visibility is weakened. Malware hidden through path-manipulation techniques may still need to download payloads, contact command-and-control infrastructure, resolve suspicious domains, move laterally, or exfiltrate information. DNS security, intrusion prevention, application control, malware analysis, outbound filtering, and encrypted-traffic inspection where appropriate can help identify this behaviour independently of file-system scanning.

Incident-response teams should avoid relying solely on standard recursive directory commands when investigating suspicious folders. Tools that understand NTFS reparse points and can identify junction targets without following them recursively should be used. Investigators should record the reparse-point structure, isolate the endpoint, acquire relevant forensic data, and examine the underlying parent directories directly.

The broader lesson from GhostTree is that attackers do not always need sophisticated kernel exploits or entirely new malware. They can abuse normal operating-system capabilities in unexpected combinations and target assumptions made by security products. NTFS junctions are legitimate and useful, but when scanners follow them without robust loop detection, a convenience feature becomes an evasion mechanism.

For enterprises, endpoint scanning must therefore remain only one component of a layered security architecture. Systems should be patched, file-system anomalies monitored, execution controlled, outbound traffic inspected, and suspicious behaviour correlated across multiple security layers. GhostTree shows that malware does not always need to become invisible. Sometimes it only needs to give the scanner an effectively endless amount of work.


GhostTree uses recursive NTFS junctions to generate vast numbers of valid Windows file paths. Varonis explains how the technique could cause Microsoft Defender folder scans to never complete, leaving malware undetected. [...]

Source: GhostTree Attack Abused Recursive Windows Junctions to Hide Malware via Bleeping Computer — published 16 Jun 2026.