New GhostTree Attack Causes EDR Tools to Hang, Leaving Files Unscanned

Researchers disclosed “GhostTree,” an attack technique that weaponizes NTFS junctions to build recursive and branching directory structures that produce an enormous number of unique paths to the same file. This path explosion can cause endpoint detection and response (EDR) tools and antivirus scanners to hang during recursive traversal, effectively evading scanning and leaving malicious files undetected; Varonis demonstrated the issue affecting Microsoft Defender and remediation and detection recommendations are provided.