Most threat actors invest heavily in sophisticated exploits, zero-days, and obfuscation engines. The GhostTree technique takes a fundamentally different approach — it abuses a mundane, decades-old feature of the Windows file system to make malware essentially invisible to endpoint defenses. No elevated privileges required. No kernel exploits. Just two lines of code and a foundational understanding of how NTFS handles directory traversal.

Threat Alert: Most threat actors invest heavily in sophisticated exploits, zero-days, and obfuscation engines.

The implications are significant, and defenders should be paying close attention.

Understanding the Foundation: NTFS Junctions

Windows NTFS junctions — a type of reparse point — allow one directory to transparently redirect to another. They exist for entirely legitimate purposes: maintaining backward compatibility with legacy software, reorganizing storage without physically relocating files, or creating flexible directory structures across volumes. Creating one requires nothing more than write access to the target folder and a single command-line instruction.

That accessibility is precisely what makes them attractive from an offensive perspective. Unlike many Windows internals that demand administrative elevation, junctions are available to any standard user. No UAC prompt. No special tokens. No exploitation required.

The Recursive Loop: From Shortcut to Infinite Labyrinth

The insight behind GhostTree begins with a deceptively simple observation: nothing prevents a junction from pointing back at its own parent directory. When an attacker creates a child folder within a directory and configures it as a junction back to the parent, the file system enters a logical loop. The child contains the parent, which contains the child, which contains the parent — indefinitely.

This creates a theoretically unbounded number of valid, resolvable file paths leading to the same executable or payload. The practical depth of the loop is constrained only by Windows' maximum path length — traditionally 260 characters, though extendable to 32,767 via registry modification. Even with the default limit, a single-character folder structure can produce approximately 126 nested directory levels before hitting the ceiling.

GhostBranch vs. GhostTree

Researchers identified two distinct variants of this technique, differing primarily in path diversity:

  • GhostBranch uses a single recursive junction, creating a linear chain of repeated directory names. With the 260-character path cap, this produces roughly 126 unique directory structures — substantial, but ultimately linear in scale.
  • GhostTree introduces two child junctions, both pointing back to the parent. This transforms the linear chain into a binary tree structure. At each depth level, the path can branch through either child directory. With 126 levels of possible depth and two choices at every node, the total number of unique valid paths reaches approximately 2126 — a number in the range of 8.5 × 1037.
To place that figure in context: 8.5 × 1037 exceeds the estimated number of atoms in the human body by ten orders of magnitude. No scanner can enumerate this space in any meaningful timeframe.

The Defender Blind Spot

The offensive application is straightforward and alarming. An attacker places a malicious payload in a parent directory, then constructs the GhostTree junction structure within that same folder. When a security tool — whether a command-line utility, an EDR agent, or Windows Defender itself — attempts to recursively scan that directory, it follows the junction chain. The scan continues indefinitely, chasing paths that loop back on themselves, consuming resources and time while never reaching termination.

The malicious files sitting in the parent directory go completely unexamined. The scan doesn't fail with an error. It simply never completes. From the security tool's perspective, it's still working. From the attacker's perspective, the payload is effectively invisible.

Testing confirmed this behavior against Windows Defender specifically, where folder scan operations could be indefinitely stalled using this method. The issue was reported to Microsoft; the response and any resulting remediation remain a point of concern for the broader security community.

Why This Technique Demands Attention

Several characteristics make GhostTree particularly notable from a threat modeling standpoint:

Why This Technique Demands Attention
Low barrier to entry: Standard user privileges are sufficient — no exploitation chain or privilege escalation is required before deployment.
Passive evasion: Unlike techniques that actively interfere with security software, GhostTree simply exhausts the scanner's ability to complete its task. This makes it harder to detect as malicious behavior.
Legitimate feature abuse: Because junctions serve genuine administrative purposes, blocking their creation outright would break legitimate workflows. Defenders cannot simply disable the capability.
Broad applicability: Any security product that relies on recursive directory traversal — not just Defender — is potentially susceptible to this category of attack.

What You Should Do

Organizations cannot wait for a patch that may not come. Proactive defensive measures should be evaluated and implemented now:

  • Audit junction creation activity: Monitor for the use of mklink /J or equivalent programmatic junction-creation APIs in your environment, particularly in user-writable directories. Legitimate administrative use is typically infrequent and scoped to specific contexts.
  • Implement depth limits in scanning workflows: Work with your EDR and security tooling vendors to confirm whether their scan engines enforce maximum recursion depth limits. If they do not, advocate for this control to be added.
  • Review user-writable directory exposure: Restrict write access to sensitive or monitored directories where possible. The attack requires write access — shrinking that surface area reduces opportunity.
  • Supplement folder-based scanning with behavioral detection: Process behavior, network telemetry, and memory analysis are not affected by file system path manipulation. A layered detection strategy that does not rely solely on recursive disk scanning is more resilient to this class of attack.
  • Test your own tools: Run a controlled GhostTree structure in a sandboxed environment and verify whether your current endpoint security stack handles it gracefully or hangs indefinitely. The results may be instructive.

GhostTree is a reminder that some of the most effective evasion techniques don't require cutting-edge exploit development — they require a careful reading of how trusted operating system features actually behave under adversarial conditions. The file system has always been a battlefield. Defenders need to treat it that way.