Attackers do not need admin rights to make recursive file scanning fail. A writable NTFS junction can point back into its own parent and turn a normal directory walk into an endless loop, so the scanner keeps finding new paths instead of reaching the files that matter. Varonis’s GhostTree research shows this can hang Microsoft Defender folder scans and similar EDR sweeps on Windows. The affected surface is any tool that trusts recursion to eventually terminate and clear a tree. The practical risk is a denial-of-scan condition on attacker-controlled folders. If the scan never finishes, co-located malware can sit in the same directory and go uninspected.
Part of the PlainSec briefing for 2026-06-17