Mike

File system redirection has long been a tool for attackers seeking privilege escalation. RedirectionGuard, a new Windows mitigation, is designed to block malicious junction-based redirection by default, strengthening system security. Key Features of RedirectionGuard: •Blocks junction traversal only when followed by an opted-in process and when created by a non-admin user. •Stores privilege metadata in an admin-only alternate data stream to verify junction trustworthiness. •Already enabled in Windows Insider builds for User Profile Service, AppX Deployment Service, and Installer Service, historically among the most vulnerable components. Learn more in our new blog by Mike Macelletti (@pintostart), Senior Security Researcher, Microsoft: msft.it/6018SIil0 Many thanks to Georgios Baltas (@gebaltas) and James Forshaw (@tiraniddo) for their contributions.