GhostTree: The NTFS Trick That Can Make Malware Disappear from EDR Scans

Original text by Dolev Taler

Varonis Threat Labs describes GhostTree, a Windows path-manipulation technique that abuses NTFS junctions to create recursive directory structures and disrupt security scanning. NTFS junctions are legitimate reparse points that redirect one folder to another, and ordinary users can create them if they have write access. The simpler GhostBranch variant points…

https://core-jmp.org/2026/05/ghosttree-the-ntfs-trick-that-can-make-malware-disappear-from-edr-scans/