Initial commit for the frontend of the windows fake file system token

frontend_vue/src/components/constants.ts

@@ -20,6 +20,7 @@ export const TOKENS_TYPE = {
   FAST_REDIRECT: 'fast_redirect',
   SLOW_REDIRECT: 'slow_redirect',
   SENSITIVE_CMD: 'cmd',
+  WINDOWS_FAKE_FS: 'windows_fake_fs',
   AZURE_ID: 'azure_id',
   MICROSOFT_EXCEL: 'ms_excel',
   MICROSOFT_WORD: 'ms_word',

frontend_vue/src/components/tokens/types.ts

@@ -61,6 +61,8 @@ type CanaryDropType = {
   browser_scanner_enabled: boolean;
   wg_key: string;
   cmd_process: string;
+  windows_fake_fs_root: string;
+  windows_fake_fs_file_structure: string;
   slack_api_key: string;
   cc_id: string;
   cc_kind: string;

frontend_vue/src/components/tokens/windows_fake_fs/ActivatedToken.vue

@@ -0,0 +1,39 @@
+<template>
+  <TokenDisplay :token-data="tokenData" />
+  <base-message-box
+    class="mt-24"
+    variant="info"
+    message="Once installed (with admin permissions) you'll get an alert whenever someone
+  (or someone's code) accesses or copies files in your fake file system."
+  />
+  <p class="mt-24 text-sm">
+    It will automatically provide the file that was accessed, and the process used
+    to access or copy the file.
+  </p>
+  <p class="mt-16 text-sm"></p>
+  <base-message-box
+    class="mt-24"
+    variant="warning"
+    message="In order to ensure that the token setup works ensure you
+    are running the powershell script as admin."
+  />
+</template>
+
+<script setup lang="ts">
+import { ref } from 'vue';
+import TokenDisplay from './TokenDisplay.vue';
+import type { NewTokenBackendType } from '@/components/tokens/types';
+
+const props = defineProps<{
+  tokenData: NewTokenBackendType;
+}>();
+
+const tokenData = ref({
+  token: props.tokenData.token || '',
+  auth: props.tokenData.auth_token || '',
+});
+
+const recommendedReg = ref(
+  'reg import FILENAME /reg:64  \nreg import FILENAME /reg:32'
+);
+</script>

frontend_vue/src/components/tokens/windows_fake_fs/GenerateTokenForm.vue

@@ -0,0 +1,30 @@
+<template>
+  <BaseGenerateTokenSettings setting-type="Canarytoken">
+    <BaseFormTextField
+      id="windows_fake_fs_root"
+      type="text"
+      placeholder="Directory Path"
+      label="The root directory for the fake file system"
+      helper-message="C:\Secrets"
+      full-width
+      required
+    />
+    <div class="flex flex-col gap-16 mt-24 mb-32">
+      <BaseFormSelect
+        id="windows_fake_fs_file_structure"
+        label="Industry Generated File Tree"
+        :options="['option1', 'option2', 'option3']"
+        placeholder="Select an option"
+        full-width
+        required
+      />
+    </div>
+  </BaseGenerateTokenSettings>
+  <GenerateTokenSettingsNotifications
+    memo-helper-example="Fake file system token on off-site backup server"
+  />
+</template>
+
+<script setup lang="ts">
+import GenerateTokenSettingsNotifications from '@/components/ui/GenerateTokenSettingsNotifications.vue';
+</script>

frontend_vue/src/components/tokens/windows_fake_fs/ManageToken.vue

@@ -0,0 +1,22 @@
+<template>
+  <div v-if="!tokenData">Error loading</div>
+  <TokenDisplay
+    v-else
+    :token-data="tokenData"
+  />
+</template>
+
+<script lang="ts" setup>
+import { ref } from 'vue';
+import TokenDisplay from './TokenDisplay.vue';
+import type { ManageTokenBackendType } from '@/components/tokens/types.ts';
+
+const props = defineProps<{
+  tokenBackendResponse: ManageTokenBackendType;
+}>();
+
+const tokenData = ref({
+  token: props.tokenBackendResponse?.canarydrop?.canarytoken?._value || '',
+  auth: props.tokenBackendResponse.canarydrop?.auth || '',
+});
+</script>

frontend_vue/src/components/tokens/windows_fake_fs/TokenDisplay.vue

@@ -0,0 +1,38 @@
+<template>
+  <div class="flex justify-center">
+    <base-button
+      class="mt-16"
+      @click="handleDownloadMSregistryFile"
+      >Download your powershell script</base-button
+    >
+  </div>
+</template>
+
+<script setup lang="ts">
+import { downloadAsset } from '@/api/main';
+
+type FakeWindowsFSDataType = {
+  auth: string;
+  token: string;
+};
+
+const props = defineProps<{
+  tokenData: FakeWindowsFSDataType;
+}>();
+
+async function handleDownloadMSregistryFile() {
+  const params = {
+    fmt: 'windows_fake_fs',
+    auth: props.tokenData?.auth,
+    token: props.tokenData?.token,
+  };
+  try {
+    const res = await downloadAsset(params);
+    window.location.href = res.request.responseURL;
+  } catch (err) {
+    console.log(err, 'File download failed');
+  } finally {
+    console.log('Download ready');
+  }
+}
+</script>

frontend_vue/src/components/tokens/windows_fake_fs/howToUse.ts

@@ -0,0 +1,5 @@
+export const howToUse = [
+  "Create a path to for us to create an empty folder, it can be C:\Secrets or C:\Users\thinkst\Documents\MySecretFiles",
+  "Then we'll create scheduled task that runs when you logon, and creates several files there",
+  "When an attacker opens or copies these files you will get an alert",
+];

frontend_vue/src/utils/formValidators.ts

@@ -85,6 +85,9 @@ export const formValidators: ValidateSchemaType = {
         }),
     }),
   },
+  [TOKENS_TYPE.WINDOWS_FAKE_FS]: {
+    schema: Yup.object().shape(validationNotificationSettings),
+  },
   [TOKENS_TYPE.MICROSOFT_EXCEL]: {
     schema: Yup.object().shape(validationNotificationSettings),
   },

frontend_vue/src/utils/tokenServices.ts

@@ -180,6 +180,21 @@ export const tokenServices: TokenServicesType = {
     category: TOKEN_CATEGORY.MICROSOFT,
     keywords: ['windows', 'cmd']
   },
+  [TOKENS_TYPE.WINDOWS_FAKE_FS]: {
+    label: 'Windows Fake File System',
+    description: 'Get an alert when a attacker accesses a file in the fake file system.',
+    documentationLink:
+      'https://docs.canarytokens.org/guide/TBD.html',
+    icon: `${TOKENS_TYPE.WINDOWS_FAKE_FS}.png`,
+    instruction: '',
+    howItWorksInstructions: [
+      'We give you a Powershell script.',
+      'You run the script to configure the fake file system on your machine.',
+      'We send you an alert if an attacker opens or copies a file.',
+    ],
+    category: TOKEN_CATEGORY.MICROSOFT,
+    keywords: ['windows', 'windows_fake_fs', 'fake', 'file']
+  },
   [TOKENS_TYPE.WEB_IMAGE]: {
     label: 'Web image',
     description: 'Get an alert when an image you upload to us is viewed.',