Well this is fun.
https://www.varonis.com/blog/ghosttree-ntfs-trick
> With just two lines of code, a user can generate endless valid paths, making it impossible to finish scanning parent directories with the dir command recursively. The same applies to EDR products that scan folders for malicious files. An attacker places malware in the parent directory, sets up the GhostTree structure, and the containing folder becomes effectively unscannable. The scan hangs. The malicious files go unexamined.
:rainbowCrow:
npub1s6…8n008
2026-05-19 19:44:54 UTC
Author Public Key
npub1s6eewzr2zvz3ppsa6k8j2hadamsug7q4rp068wmz3grtf440xxkqr8n008Published at
2026-05-19 19:44:54 UTCEvent JSON
{
"id": "312d74de4c1ff6ecf68ff2f9b64e3c9c5d4a460877b1272403c5dcf5ae9380cc",
"pubkey": "86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac",
"created_at": 1779219894,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@cR0w/116602955025175122",
"web"
],
[
"proxy",
"https://infosec.exchange/users/cR0w/statuses/116602955025175122",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/cR0w/statuses/116602955025175122",
"pink.momostr"
],
[
"-"
]
],
"content": "Well this is fun.\n\nhttps://www.varonis.com/blog/ghosttree-ntfs-trick\n\n\u003e With just two lines of code, a user can generate endless valid paths, making it impossible to finish scanning parent directories with the dir command recursively. The same applies to EDR products that scan folders for malicious files. An attacker places malware in the parent directory, sets up the GhostTree structure, and the containing folder becomes effectively unscannable. The scan hangs. The malicious files go unexamined.",
"sig": "12879a6f62dd280ca159f1bda2eb4a1e08346c0d129c4151db3f3596f3c747b3657a0b84f974870a71044cd73baee4efb29c8357a7d8aa0c9b6b04f839fcb10a"
}