Windows ProjFS Internals Reveal File-Read Controls and Defensive Canary Uses
Summary
A technical walkthrough explains how Windows ProjFS uses a minifilter and provider to virtualize files, control some file operations, vary read results by process, and support file-access canaries.
Key points
- ProjFS projects files from a backing store and hydrates them when accessed; enabling the feature requires administrator privileges, but a provider can be started by a medium-integrity user.
- The article explains that ProjFS is a minifilter using reparse points and filter communication ports to coordinate with user-mode providers.
- Providers can deny selected delete, rename, or hard-link operations through pre-operation notifications.
- A provider can deny reads or return different contents to different processes; changing results for later reads requires the earlier file handle to close before the file is rehydrated.
- ProjFS notifications expose file activity and triggering-process details, which the author identifies as useful for canary files and ransomware visibility.
- The author notes that ProjFS offers less control than a minifilter and limited blocking capability.
Article Details
- Topic
- Windows Projected File System (ProjFS) internals and its offensive and defensive security use cases, including canary-file monitoring and process-dependent file access or content projection.
People
Vendors
Products
Microsoft WindowsHomeBlogThe Phantom File System: Inside the Windows ProjFSNTFSThe Windows operating system supports many different file systems, the most common being NTFS. In Windows 1809, Microsoft introduced a new file system called the Projected File System (ProjFS).Projected File System (ProjFS)The Windows operating system supports many different file systems, the most common being NTFS. In Windows 1809, Microsoft introduced a new file system called the Projected File System (ProjFS).WinDbgThis can be seen by either running fltmc.exe in a command prompt or by running the WinDbg command !fltkd.filters:
Tools
fltmc.exeThis can be seen by either running fltmc.exe in a command prompt or by running the WinDbg command !fltkd.filters:fsutil.exeProgrammatically, one can query a reparse point by passing in FSCTL_GET_REPARSE_POINT into DeviceIoControl, but Windows has an application called fsutil.exe that makes this a bit easier: