GhostLock tool abuses Windows API to deny file access

A security researcher has released a proof-of-concept tool named GhostLock that demonstrates how a legitimate Windows file API can be abused to block access to files stored locally or on SMB network shares ¹. The technique, created by Kim Dvash of Israel Aerospace Industries, exploits the Windows CreateFileW API and file-sharing modes to prevent other users and applications from opening files while handles remain active ¹.

GhostLock abuses the dwShareMode parameter in the CreateFileW() function, which controls what access other processes have to an open file ¹. When a file is opened with dwShareMode = 0, Windows grants the process exclusive access, preventing other users or applications from opening it ¹.

The researcher has published the GhostLock tool on GitHub, which automates the attack by recursively opening large numbers of files on SMB shares ¹. Standard domain users can run it without elevated privileges ¹.

File access is restored once the associated SMB session terminates, the GhostLock processes are killed, or the affected system reboots—Windows automatically closes the handles ¹. Dvash told Bleeping Computer that the technique should be viewed primarily as a disruption attack rather than a destructive one ¹.

"Yes, the impact is disruption-based, not destructive. The parallel to ransomware is the operational downtime window, not data loss," Dvash told Bleeping Computer ¹.

This attack resembles a denial-of-service technique. Attackers could use widespread file-access disruptions to overwhelm IT staff while conducting data theft, lateral movement, or other malicious activity elsewhere in the environment ¹.

Many security products and behavioural detection systems focus on mass file writes or encryption operations ¹. GhostLock primarily generates legitimate file open requests in volume, making detection less likely ¹.

"The only observable that reliably identifies this attack is the per-session open-file count with ShareAccess = 0 at the file server layer—a metric that lives inside storage platform management interfaces, not in Windows event logs, not in EDR telemetry, not in network flow data," Dvash explained ¹.