TLDR Tech / InfoSec
The Phantom File System: Inside the Windows ProjFS
The Windows Projected File System (ProjFS) operates as a minifilter (prjflt.sys) rather than a true filesystem, using reparse points and filter communication ports to project virtual files on demand. Offensively, medium-integrity users can launch ProjFS providers without admin privileges, prevent higher-privileged processes from deleting files, and serve different file contents per process — all potential avenues for evasion and persistence. Defensively, ProjFS offers a lightweight alternative to custom minifilters for deploying canary files with rich callback data, including triggering process ID and image path, particularly relevant as Microsoft moves toward reducing kernel-mode dependencies.
Read the full story