GhostLock leverages the Windows CreateFileW API with dwShareMode=0 to lock local and SMB-shared files in exclusive mode, causing sharing violations without data loss. Operates under standard domain users. #GhostLock #FileLocking #WindowsAPI
New GhostLock tool abuses Windows API to block file access
GhostLock is a proof-of-concept tool that abuses the Windows CreateFileW API and SMB file-sharing behavior to block access to files by opening them in exclusive mode. The technique can be run by standard domain users, causes sharing violations without encrypting or deleting data, and may be used to distract defenders while other intrusions continue. #GhostLock #CreateFileW #SMB
www.hendryadrian.com
May 11, 2026 at 10:45 PM
GhostLock leverages the Windows CreateFileW API with dwShareMode=0 to lock local and SMB-shared files in exclusive mode, causing sharing violations without data loss. Operates under standard domain users. #GhostLock #FileLocking #WindowsAPI