When a Windows Shortcut Becomes a Scanner Trap

Windows file systems are built to redirect, link, and reuse paths. That flexibility is useful for administrators - and awkward for security tools that assume every directory walk will eventually end. A technique dubbed GhostTree illustrates that tension by using NTFS junctions to create recursive directory loops that may cause endpoint scanners to stall or skip file checks.

Fast Facts

• GhostTree is described as an NTFS junction-based evasion technique.
• Recursive directory loops can confuse tools that scan file trees by following paths one by one.
• Endpoint scanners may hang or miss file checks if they do not handle reparse points safely.
• The demonstration is tied to Windows filesystem behavior, not to a custom malware-only feature.
• Defensive settings around junctions and reparse points matter for scan coverage.

How the trap works

NTFS junctions are a form of reparse point: a built-in Windows mechanism that redirects one directory to another location. That redirection is legitimate, but it also creates a control-flow problem for software that performs recursive enumeration. If a scanner follows a junction back into an ancestor directory, it can revisit the same content through a different path string and keep walking in circles.

From a defensive perspective, the danger is not that the file system itself is broken. The danger is that the inspection engine may treat a path as new when it is actually a loop. In the worst case, that can make a scan appear stuck. In other cases, the product may give up on the problematic branch and continue elsewhere, leaving some files unexamined until the next scan window.

The public technical description frames this as a scanner-logic weakness: a legitimate redirection feature becomes an evasion primitive when traversal code lacks cycle detection, object-based tracking, or strict limits on recursion depth. That is why this kind of issue belongs in the same conversation as reparse-point handling, long-path edge cases, and endpoint protection policy.

At the time of writing, public information has not fully established the complete product-by-product impact, or whether every deployment would behave the same way. The available information supports a risk analysis, not a definitive claim of universal failure.

Why defenders should care

The broader lesson is simple: path strings are not identities. A tool that trusts the visible directory tree more than the underlying object model can be led into repeated work, incomplete scans, or false confidence. That matters for EDR and antivirus products because their value depends on timely, reliable coverage of the filesystem - especially in writable locations where a low-privileged user may be able to create junctions if permissions allow it.

Good defensive design here is not exotic. Security tools should record visited targets, enforce explicit recursion and time limits, and surface incomplete scans as operational events rather than silent success. Administrators should also validate how endpoint software handles reparse points in their environment, because Windows exposes those behaviors as configurable policy in some products.

Conclusion

GhostTree is a reminder that attackers do not always need a new payload to create a new problem. Sometimes they only need a filesystem feature that defenders have not modeled carefully enough. In Windows, the smallest redirect can become the largest blind spot if recursive scanning is not built to recognize a loop.

WIKICROOK

• NTFS junction: A Windows directory link that redirects one folder to another location on the same volume.
• Reparse point: A filesystem object that triggers special handling, often used for links, mounts, and redirection.
• Recursive scan: A process that walks through a folder and its subfolders to inspect all reachable files.
• Cycle detection: A method for recognizing repeated traversal paths and preventing infinite loops.
• EDR: Endpoint Detection and Response tools that monitor devices for suspicious behavior and threats.