Microsoft hardens Windows 11 against file junction attacks
Source Reddit NetSec
Rated by Threat Radar
Data as of 8 Jul 2025, 00:54 UTC
What to do
AI-suggested
European organizations should take the following specific steps to mitigate risks related to file junction attacks on Windows 11: 1) Evaluate and enable the Redirection Guard process mitigation policy in controlled test environments to assess compatibility with existing applications and workflows. 2) Update Windows 11 systems to the latest security builds that include this mitigation, ensuring that all endpoints are uniformly protected. 3) Conduct audits of file system junctions and reparse points to identify and remove or secure any unnecessary or suspicious junctions that could be exploited. 4) Implement strict access controls and monitoring on directories commonly targeted for redirection attacks, such as system and program files directories. 5) Integrate detection capabilities in endpoint security solutions to alert on unusual file system redirection or junction creation activities. 6) Train IT and security teams on the risks of file junction attacks and the operational impact of enabling Redirection Guard to ensure smooth deployment. 7) Maintain a robust patch management process to quickly apply future updates related to this mitigation or related vulnerabilities. These measures go beyond generic advice by focusing on the specific mitigation introduced by Microsoft and the operational considerations for European enterprises.
Description
Microsoft's security team has announced a new process mitigation policy to protect against file system redirection attacks. "Redirection Guard, when enabled, helps Windows apps prevent malicious junction traversal redirections, which could potentially lead to privilege escalation by redirecting FS operations from less privileged locations to more privileged ones.