Windows Projected File System The Reality Stone

The speaker presents a token type built on the Windows Projected File System, a feature included in later versions of Windows, as part of the open-source Canary Tokens project. The aim is to place placeholder files and folders that look real to anyone enumerating a host or a network share. Because the feature ships with Windows, defenders don't need to install an agent or extra software to deploy it.

The middle of the talk covers the internals. A provider runs a user-mode process, registers callbacks, and exposes a virtualization root, while reparse points mark which directories are projected. When an attacker opens or copies a decoy file, a callback receives the requesting process ID and the resolved path. The token then sends that information back as a base32-encoded DNS lookup. Directory enumeration is deliberately not alerted on, so that the signal stays high. The speaker also shows how to spot the feature with fsutil, tasklist and fltmc, and notes that these indicators also appear on legitimate systems.

The closing section raises open questions. The speaker asks for feedback on false positives from antivirus products and from tools such as ShareFinder and Snaffler, and suggests that callbacks could return different data depending on the calling process. The practical takeaway is that built-in Windows features can provide low-noise tripwires, and that offensive researchers will likely look for the markers that reveal projected directories. Reference C and PowerShell code is published on the project's GitHub page.