Our Data Extortion Prevention software receives behavioral indicators from several engines before making a split-second decision whether an attack is at hand. One of the engines, the file monitoring engine, uses special files in several locations.
Those files you sometimes see, sometimes not, are there by Cyber Crucible. Depending on how an application may list files, you may see them. For example, a program that use File Explorer to list files to save or open, will now show you them.
We call those files canaries, like, “canary in the coal mine” (wiki).