GhostTree Attack Freezes EDR Products, Skips File Scans

Key Takeaways

• A new evasion technique, dubbed GhostTree, exploits Windows NTFS junctions to create recursive directory loops.
• This method causes Endpoint Detection and Response (EDR) products to freeze or hang during scans, leaving malicious payloads undetected.
• GhostTree is an advanced variant of the GhostBranch attack, exponentially increasing the number of deceptive file paths.
• Microsoft initially dismissed the issue but later released a patch to address the underlying recursive scanning vulnerability.
• Organizations should implement defense-in-depth strategies and monitor for unusual junction creation.

A sophisticated evasion method, named GhostTree, has been identified that leverages Windows NTFS junctions to construct recursive directory loops. This technique effectively paralyzes Endpoint Detection and Response (EDR) scanners, trapping them in infinite path traversals and rendering them incapable of detecting co-located malicious files.

The discovery, made by Varonis Threat Labs, highlights a critical vulnerability in how security products process file system structures, enabling attackers to bypass detection with relative ease.

NTFS junctions are akin to advanced symbolic links, designed to transparently redirect applications from one directory to another. Their utility for threat actors stems from the fact that creating these junctions requires only standard write permissions, not elevated administrative privileges. An attacker can simply use the mklink /J command in the Windows terminal to establish a new link to a target directory.

The GhostTree Attack Mechanism

While the NTFS file system inherently supports extensive path lengths, older software components within Windows often impose practical limits on path depth. Traditionally, Windows architectures enforce a maximum path length of 260 characters, which limits the extent of recursive directory loops.

The precursor to GhostTree, known as GhostBranch, involves an attacker creating a junction where a child directory points directly back to its parent. This configuration forms a logical loop, causing the child folder to endlessly replicate the parent’s contents, including itself. Attackers employing single-letter folder names can nest directories to approximately 126 levels deep.

GhostTree significantly escalates this threat by linking multiple child directories back to the same parent folder. This dual-node setup generates an exponential number of distinct file paths, estimated at approximately 2¹²⁶, leading to a single executable. The resulting directory structure resembles an intricate binary tree that recursively branches until it encounters operating system limitations.

Impact on EDR Scanning

When security solutions attempt to recursively scan these meticulously crafted directories, their scanning engines become ensnared in the perpetually generating paths. The EDR product becomes entirely consumed by the directory loop, eventually hanging without completing its scan. Crucially, any actual malware positioned alongside the junction remains unscanned and completely undetected by the endpoint agent.

The simplicity of these evasion techniques belies their severe impact on file system analysis. Defenders must grasp the exponential scaling differences between GhostBranch and GhostTree to appreciate the amplified threat posed by the latter.

Varonis researchers successfully validated this evasion technique by testing it against Windows Defender. Initially, Microsoft closed the bug report, asserting that bypassing an antivirus engine did not constitute a security boundary violation. However, Microsoft subsequently deployed a patch to mitigate the underlying recursive scanning vulnerability.

Given that native endpoint scanners can be subverted by these logical file loops, organizations are urged to implement robust defense-in-depth strategies.

What You Should Do

• Monitor for Anomalous Junction Creation: Security operations centers (SOCs) should actively monitor file access events at the data layer to detect the unusual creation of NTFS junctions.
• Identify Recursive Directory Structures: Implement detection mechanisms to identify recursive directory structures that deviate from normal operational patterns. This is crucial for pinpointing GhostTree activity before malicious payloads can execute.
• Apply Patches: Ensure all Windows systems and EDR products are kept up-to-date with the latest security patches, including the one released by Microsoft addressing this recursive scanning vulnerability.
• Enhance EDR Configuration: Review and enhance EDR configurations to potentially identify and block the creation of excessive or suspicious NTFS junctions.
• Implement Layered Security: Rely on a multi-layered security approach that includes network segmentation, strong access controls, and behavioral analysis to detect post-exploitation activities even if initial EDR scans are bypassed.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.