New GhostLock tool abuses Windows API to block file access
Implement SIEM queries and NDR detection rules to monitor for excessive exclusive file opens on SMB shares.
Implement SIEM queries and NDR detection rules to monitor for excessive exclusive file opens on SMB shares.
Summary
Security researcher Kim Dvash released GhostLock, a proof‑of‑concept that abuses the Windows CreateFileW API’s dwShareMode parameter to lock files exclusively on SMB shares. By opening files with dwShareMode = 0, the tool prevents other processes from accessing the file, causing STATUS_SHARING_VIOLATION errors for any subsequent attempts. GhostLock can be run by standard domain users and does not require elevated privileges, allowing attackers to lock thousands of files across multiple compromised devices. The technique is a denial‑of‑service attack rather than destructive, but it can be used to distract IT staff while attackers conduct lateral movement or data theft. Detection is difficult because the tool generates legitimate file‑open requests; the only reliable observable is the per‑session open‑file count with ShareAccess = 0 at the file‑server layer. Dvash provided SIEM queries and NDR detection rules to help defenders spot the pattern. The tool’s persistence is lost when the SMB session ends, the process is killed, or the system reboots. GhostLock demonstrates how legitimate Windows APIs can be weaponised for disruption.
Key changes
- GhostLock abuses CreateFileW dwShareMode = 0 to lock files exclusively on SMB shares.
- Tool recursively opens thousands of files, causing STATUS_SHARING_VIOLATION errors for other processes.
- Requires no elevated privileges; can be run by standard domain users.
- Persistence is lost when SMB session ends, process killed, or system reboots.
- Detection relies on per‑session open‑file count with ShareAccess = 0 at the file‑server layer.
- SIEM queries and NDR detection rules were provided by researcher.
- Technique is a denial‑of‑service attack, not destructive, but can distract IT staff.
- Could be used to cover lateral movement or data theft while attackers operate elsewhere.