GhostTree Attack Causes EDR Tools to Hang, Skip File Scans

A novel evasion GhostTree technique exploits NTFS junctions to create recursive directory loops.

Uncovered by Varonis Threat Labs, this trap uses Endpoint Detection and Response (EDR) scanners to create infinite paths, causing them to hang indefinitely and ignore malicious payloads sitting in plain sight.

NTFS junctions function as advanced shortcuts that seamlessly redirect applications from one directory to another without user interaction.

Threat actors favor this feature because creating a junction requires only standard write permissions rather than administrative privileges, making it accessible to any low-privileged user on a compromised system.

Attackers execute the mklink /J command in the Windows terminal to link a new path to a target directory, leaving no obvious trace of malicious intent, said varonis.

While the NTFS file system natively supports extended path lengths, legacy software imposes significant restrictions on the practical path depth across the operating system.

Classic Windows architectures enforce a strict maximum path length of 260 characters, which ultimately caps how deep recursive directory loops can extend, but does not prevent the attack from being highly effective.

GhostTree Attack on EDR

The foundational GhostBranch technique involves an adversary creating a junction that points a child directory directly back to its parent.

This misconfiguration creates a logical loop in which the child folder endlessly replicates the parent’s contents, including itself.

Using single-letter folder names to maximize path depth, attackers can nest directories to a maximum depth of approximately 126 levels, generating around 126 unique recursive directory structures within the 260-character OS limit.

GhostTree exponentially amplifies this threat by linking multiple child directories back to the same parent folder.

This dual-node configuration generates approximately $2^{126}\approx 8.5\times {10}^{37}$2126≈8.5×1037 distinct file paths, presenting an astronomical number of routes to a single executable.

The resulting directory structure resembles a complex binary tree that branches recursively until hitting OS limits, dwarfing the estimated number of atoms in the human body (${10}^{27}$1027) and grains of sand on Earth ($8.5\times {10}^{18}$8.5×1018).

When security products attempt to scan these manipulated directories recursively, they continuously traverse the infinitely generated paths.

The scanning engine becomes entirely consumed by the directory loop and ultimately hangs, leaving the task incomplete.

Any malware placed alongside the junction in the parent directory remains completely unscanned and undetected by the endpoint agent, with no kernel vulnerabilities exploited or elevated privileges required.

Varonis researchers successfully validated this evasion technique by testing it directly against Windows Defender.

Microsoft initially closed the bug report without taking action, stating that bypassing an antivirus engine does not constitute crossing a defined security boundary.

Despite this stance, Microsoft eventually deployed a patch to resolve the underlying recursive scanning vulnerability.

Mitigation:

Because logical file loops can subvert native endpoint scanners, organizations must implement defense-in-depth strategies. Security Operations Centers (SOCs) should take the following steps:

• Monitor junction creation events using Sysmon or SIEM rules to flag anomalous mklink /J activity targeting parent directories
• Detect recursive directory structures that deviate from normal operational patterns. Self-referencing junctions have no legitimate business use.
• Apply data-layer file access monitoring to catch abnormal traversal behaviors that endpoint scanners are structurally incapable of detecting.
• Enforce write-permission audits on sensitive directories to prevent standard users from creating junctions without permission.
• Implement scanning depth limits in EDR configurations to prevent infinite traversal when anomalous recursive structures are identified.

GhostTree is a reminder that the most dangerous attack techniques often require no malware at all, just a deep understanding of the operating system’s own features.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.