Defensive Architecture: GhostLock: Abusing the Windows File API for 'Encryption-less' Ransomware

The GhostLock POC demonstrates how a legitimate Windows API, `LockFileEx`, can be used to achieve the primary goal of ransomware—denial of access—without the need for complex encryption logic. By opening a file with exclusive access and holding the handle, an attacker can prevent any other process (including the user or backup software) from reading or writing to the file.

HANDLE hFile = CreateFile(targetPath, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFile != INVALID_HANDLE_VALUE) {
    // Abuse LockFileEx to deny all access to other processes
    OVERLAPPED overlapped = {0};
    LockFileEx(hFile, LOCKFILE_EXCLUSIVE_LOCK, 0, 0xFFFFFFFF, 0xFFFFFFFF, &overlapped);
    // Keep handle open to maintain the lock indefinitely
}

Standard EDRs look for 'file write' patterns associated with encryption (read-modify-write). GhostLock bypasses this by only 'reading' and 'locking.' Mitigation requires monitoring for processes that open a high volume of handles with `LOCKFILE_EXCLUSIVE_LOCK` and no subsequent I/O activity.