alloysecuregroup/phantomfs

PhantomFS is a Windows tool that creates a fake folder full of convincing but fake files, things like financial reports, SSH keys, and spreadsheets of employee salaries, to catch anyone who should not be looking through them. It uses a Windows feature called the Projected File System to make these files appear real in File Explorer, even though nothing is actually written to disk until someone opens one. The idea is that a legitimate user has no reason to open files they did not create, so any attempt to read one is treated as a strong signal that something is wrong, whether that is an outside attacker who broke in or an employee looking where they should not be. The moment a decoy file is opened, PhantomFS writes an entry to the Windows Event Log, sends a desktop notification, and records which process touched the file along with the exact time. If the file was reached over a shared network folder, it also tries to capture the username and address of the remote computer that opened it. After a file has been opened and its content generated, PhantomFS can automatically delete that copy after a configurable delay, so it reverts back to being a placeholder and will trigger an alert again the next time someone opens it. Setting it up requires Windows 10 or later, the .NET Framework, and turning on the Projected File System feature, plus running as an administrator. Configuration lives in a single settings file where you can turn logging and notifications on or off, adjust how often alerts can fire for the same file, and add your own list of decoy filenames and realistic file sizes. There is also a web based profile builder for generating different configuration files for different deployment scenarios. PhantomFS is released under the MIT license.