Why Are My Junctions Not Followed? Exploring Windows Redirection Trust Mitigation
Summary: Unit 42 details a Windows mitigation that marks junctions created by unprivileged, medium-integrity callers and blocks privileged processes from following them, with ntfs.sys computing a caller's trust level via nt!IoComputeRedirectionTrustLevel and checking it through nt!IoCheckRedirectionTrustLevel. The mitigation, controlled by the ProcessRedirectionTrustPolicy process mitigation policy in audit or enforce mode, was found enabled only in audit mode for several services on the Windows build tested, with failed redirects returning error 0xc00004be.
Key Takeaway: Junctions became attackers' preferred route for file system redirection after Microsoft's 2019 hard-link mitigation, and the new defense sitting in audit mode for several services means those redirects are logged, not stopped, on the build tested.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2020-0787
- Related
- CVE-2020-0787: Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability Known Exploited Vulnerabilities · Jan 28, 2022University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026