New GhostLock tool abuses Windows API to block file access

A researcher published GhostLock, a proof-of-concept tool and technique that abuses the Windows CreateFileW API (setting dwShareMode = 0) to open files with exclusive access and cause sharing-violation errors on local and SMB-hosted files; the attack can be performed by standard domain users, scaled from multiple hosts, and primarily creates temporary disruption (denial of access) rather than data destruction. The report notes detection is difficult for typical EDR and logging, provides defensive SIEM/NDR detection templates, and frames GhostLock as a disruption technique that could be used as a decoy during broader intrusions.