GhostTree Attack Abused Recursive Windows Junctions to Hide Malware
Most security teams think of NTFS junctions and symbolic links as niche file system features. They let one directory point to another, like a shortcut that the OS treats as real.
Grace Ops
CONTENT OPTIMIZATION · AEO/GEO
Not yet scored. Next refresh: 02:00 UTC.
audit trail / provenance1
Provenance
Claims tie surfaced fields back to sources, models, or heuristics.
- severity.upliftheuristicn/aRansomware campaign indicators detected — floor raised to at least high.
What changed
Append-only revisions when ingest or analysts evolve the record.
No revision rows stored yet.
Sources
Brief grounded in 1 source.
discussion
Sign in to join the thread and vote on comments.
Loading comments…