GhostTree Attack — Recursive Junctions to Hide Malware

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•6

This rule detects the creation of suspicious files, specifically .lnk files or files containing 'JUNCTION' in their name, within the 'AppData\Local\Temp' directory. It further refines the detection to look for paths that contain '..\', indicating a recursive or unusual directory structure, which can be used to hide malware or evade detection.