GhostTree technique uses NTFS junctions to evade security scans