Detect Mark-of-the-Web Bypass in IBM QRadar

-- Branch 1: Zone.Identifier ADS Deletion (Sysmon EventID 15 = FileCreateStreamHash, or Security 4663)
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  sourceip,
  username,
  "TargetFilename",
  "Image",
  "CommandLine",
  'Zone_Identifier_ADS_Deleted' AS detection_type
FROM events
WHERE LOGSOURCETYPEID = 119  -- Microsoft Windows Security Event Log (Sysmon via WEC)
  AND "EventID" = '15'
  AND "TargetFilename" LIKE '%:Zone.Identifier'
  AND devicetime > NOW() - 86400000

UNION ALL

-- Branch 2: ADS Manipulation Tools
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  sourceip,
  username,
  NULL AS "TargetFilename",
  "Image",
  "CommandLine",
  'ADS_Manipulation_Tool' AS detection_type
FROM events
WHERE LOGSOURCETYPEID = 119
  AND "EventID" = '1'
  AND (
    LOWER("Image") LIKE '%streams.exe'
    OR LOWER("Image") LIKE '%streams64.exe'
    OR (
      (LOWER("Image") LIKE '%powershell.exe' OR LOWER("Image") LIKE '%pwsh.exe')
      AND LOWER("CommandLine") LIKE '%zone.identifier%'
      AND (
        LOWER("CommandLine") LIKE '%remove-item%'
        OR LOWER("CommandLine") LIKE '%-stream%'
        OR LOWER("CommandLine") LIKE '%clear-content%'
        OR LOWER("CommandLine") LIKE '%set-content%'
      )
    )
    OR (
      LOWER("Image") LIKE '%cmd.exe'
      AND LOWER("CommandLine") LIKE '%zone.identifier%'
    )
  )
  AND devicetime > NOW() - 86400000

UNION ALL

-- Branch 3: PowerShell Disk Image Mount
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  sourceip,
  username,
  NULL AS "TargetFilename",
  "Image",
  "CommandLine",
  'DiskImage_Mount_PowerShell' AS detection_type
FROM events
WHERE LOGSOURCETYPEID = 119
  AND "EventID" = '1'
  AND (LOWER("Image") LIKE '%powershell.exe' OR LOWER("Image") LIKE '%pwsh.exe')
  AND (
    LOWER("CommandLine") LIKE '%mount-diskimage%'
    OR LOWER("CommandLine") LIKE '%mount-vhd%'
    OR (
      (
        LOWER("CommandLine") LIKE '%.iso%'
        OR LOWER("CommandLine") LIKE '%.vhd%'
        OR LOWER("CommandLine") LIKE '%.vhdx%'
        OR LOWER("CommandLine") LIKE '%.img%'
      )
      AND (
        LOWER("CommandLine") LIKE '%mount%'
        OR LOWER("CommandLine") LIKE '%attach%'
        OR LOWER("CommandLine") LIKE '%diskpart%'
      )
    )
  )
  AND devicetime > NOW() - 86400000

UNION ALL

-- Branch 4: Execution from Mounted Volume (non-C: drive via explorer/cmd)
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  sourceip,
  username,
  NULL AS "TargetFilename",
  "Image",
  "CommandLine",
  'Exec_From_Mounted_Volume' AS detection_type
FROM events
WHERE LOGSOURCETYPEID = 119
  AND "EventID" = '1'
  AND REGEXP("Image", '^[D-Zd-z]:\\\\.*\\.(exe|dll|lnk|js|vbs|hta|bat|cmd|ps1|msi)$')
  AND (
    LOWER("ParentImage") LIKE '%explorer.exe'
    OR LOWER("ParentImage") LIKE '%cmd.exe'
  )
  AND LOWER("Image") NOT LIKE '%program files%'
  AND LOWER("Image") NOT LIKE '%games%'
  AND LOWER("Image") NOT LIKE '%steam%'
  AND devicetime > NOW() - 86400000
ORDER BY event_time DESC