Daily Edition · Page 10

THE DAILY INDEX

Technology, AI, software, security, crypto and business

Repositories, courses and useful tools

Resources & Tools

PHANTOMFS

PhantomFS is a Windows ProjFS-based tool that projects virtual files whose content varies by the requesting process, serving AES-256-CBC-encrypted payloads to allowed processes (e.g., cmd.exe) while returning decoy bytes to all others. Inspired by Huntress' recent ProjFS research, the tool runs at medium integrity without admin privileges and blocks delete/rename attempts from non-allowed processes. Detection is possible via ProjFS reparse points, the PrjFlt minifilter at filter altitude 189800, and the Microsoft-Windows-ProjFS ETW provider.

TLDR IndexPage 10