From d2dfe36ecb575b573dd42bb6241955aa7ce27815 Mon Sep 17 00:00:00 2001 From: thinkst-cs <110428675+thinkst-cs@users.noreply.github.com> Date: Fri, 13 Dec 2024 14:34:32 -0700 Subject: [PATCH 1/2] Update README.md --- file_access_token/README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/file_access_token/README.md b/file_access_token/README.md index bdd549d..f5ff79e 100644 --- a/file_access_token/README.md +++ b/file_access_token/README.md @@ -7,3 +7,13 @@ SMB example show cases how to use ProjFS to alert on share access from a remote Tarpit example shows how to create an approved Process list, and take actions, return random errors, delay loading of files etc... +Sample Invocation - Ensure `$(Get-Content .\csharp\test_file.csv -Raw)` is passed to parse the csv file. + +``` +Sample Invocation. +.\CanaryFS.ps1 -TaskName "CanaryFS" -TaskDescription "Create Fake Files" -ScriptPath "C:\users\Thinkst\data-script.ps1" -RootPath "C:\CanaryFs" + +Sample exe invocation +.\CanaryFS.exe C:\vfstest $(Get-Content .\csharp\test_file.csv -Raw) example.canarytokens.com true +``` + From 8749307218d59a2000d568ad0f4788424605381d Mon Sep 17 00:00:00 2001 From: thinkst-cs <110428675+thinkst-cs@users.noreply.github.com> Date: Fri, 13 Dec 2024 14:34:49 -0700 Subject: [PATCH 2/2] Update README.md Added Invocation examples --- file_access_token/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/file_access_token/README.md b/file_access_token/README.md index f5ff79e..617bc72 100644 --- a/file_access_token/README.md +++ b/file_access_token/README.md @@ -15,5 +15,6 @@ Sample Invocation. Sample exe invocation .\CanaryFS.exe C:\vfstest $(Get-Content .\csharp\test_file.csv -Raw) example.canarytokens.com true + ```