PDF documents can be tokenized to notify you when it has been opened. The Canarytoken works by forcing the PDF reader to reveal information about the machine that opened the document.
Follow the steps below to create a tokenized PDF document.
Step 1: Log in to your Console
Step 2: Click the Canarytokens Tile
Step 3: Select Acrobat PDF
Create a new Canarytoken by selecting Acrobat PDF from the drop-down list.
Step 4: Create a Reminder for Canarytoken
Over time, you will deploy thousands of tokens all over the place. Ensure that your Reminder is as descriptive as possible, so it will remind you in the future where the token was dropped. It may create confusion if a token generated an alert that reads "test" and you do not remember where you placed it. You can either create a blank tokenized PDF or upload your own for maximum deception.
Once you have made your selection, click on Create token.
Step 5: Download Canarytoken
Go ahead and download your tokenized PDF for placement.
Alerts
An alert is created once the PDF has been opened in Adobe Reader.
Create PDF Canarytokens without uploading the PDF to the Console
You may want to Token sensitive documents that shouldn't leave the environment.
In these cases, you have the option to Token a PDF file without it ever leaving your local endpoint.
By toggling the Keep this PDF on my device only option, the Tokening process happens within your browser, and the document is never uploaded to the Canary Console.
A quick connection is made to generate a tripwire, which is then embedded in document locally.