Detect Mark-of-the-Web Bypass in Microsoft Sentinel
Adversaries abuse container file formats such as ISO disk images, VHD/VHDX virtual hard disks, and compressed archives (ZIP, RAR, 7z, ARJ) to deliver malicious payloads that bypass Mark-of-the-Web (MOTW) protections. When a container file is downloaded from the Internet, Windows tags it with a Zone.Identifier NTFS Alternate Data Stream (ZoneId=3), but files extracted or mounted from containers typically do not inherit this tag because MOTW is an NTFS feature and many container formats do not support NTFS ADS. This allows embedded executables, scripts, and LNK files to bypass Protected View in Microsoft Office, Windows Defender SmartScreen warnings, and other MOTW-dependent security controls. Adversaries also directly manipulate or delete the Zone.Identifier ADS from already-downloaded files (Amadey sets ZoneId=0; attackers use streams.exe or PowerShell Remove-Item -Stream). This technique has been widely adopted by TA505 (ISO/LNK chains), QakBot (ISO packaging), APT29 (ISO/VHDX embedded in HTML), and APT38 (ISO/VHD delivery).
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1553 Subvert Trust Controls
- Sub-technique
- T1553.005 Mark-of-the-Web Bypass
- Canonical reference
- https://attack.mitre.org/techniques/T1553/005/
KQL Detection Query
// T1553.005 — Mark-of-the-Web Bypass Detection
// Four detection branches: ADS deletion, PowerShell mounting, execution from mounted volume, ADS manipulation tools
let ZoneIDDeletion = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileDeleted"
| where FileName has ":Zone.Identifier" or FolderPath has ":Zone.Identifier"
| extend DetectionType = "Zone.Identifier_ADS_Deleted"
| project Timestamp, DeviceName, AccountName, DetectionType, FileName, FolderPath,
InitiatingProcessFileName, InitiatingProcessCommandLine;
let DiskImageMount = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("Mount-DiskImage", "Mount-VHD")
or (ProcessCommandLine has_any (".iso", ".vhd", ".vhdx", ".img")
and ProcessCommandLine has_any ("mount", "attach", "diskpart"))
| extend DetectionType = "DiskImage_Mount_PowerShell"
| project Timestamp, DeviceName, AccountName, DetectionType, FileName,
ProcessCommandLine as CommandInfo, InitiatingProcessFileName, InitiatingProcessCommandLine;
let SuspiciousVolumeExec = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath matches regex @"^[D-Z]:\\"
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".lnk"
or FileName endswith ".js" or FileName endswith ".vbs" or FileName endswith ".hta"
| where InitiatingProcessFileName in~ ("explorer.exe", "cmd.exe")
| where not (FolderPath has_any ("Program Files", "Games", "Steam", "GOG", "Epic Games"))
| extend DetectionType = "Exec_From_Mounted_Volume"
| project Timestamp, DeviceName, AccountName, DetectionType, FileName, FolderPath,
ProcessCommandLine as CommandInfo, InitiatingProcessFileName, InitiatingProcessCommandLine;
let ADSManipulation = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("streams.exe", "streams64.exe"))
or (FileName in~ ("powershell.exe", "pwsh.exe")
and ProcessCommandLine has "Zone.Identifier"
and ProcessCommandLine has_any ("Remove-Item", "-Stream", "Clear-Content", "Set-Content", "Out-Null"))
or (FileName =~ "cmd.exe"
and ProcessCommandLine has "Zone.Identifier")
| extend DetectionType = "ADS_Manipulation_Tool"
| project Timestamp, DeviceName, AccountName, DetectionType, FileName,
ProcessCommandLine as CommandInfo, InitiatingProcessFileName, InitiatingProcessCommandLine;
union ZoneIDDeletion, DiskImageMount, SuspiciousVolumeExec, ADSManipulation
| sort by Timestamp descDetects Mark-of-the-Web bypass techniques using Microsoft Defender for Endpoint (MDE) telemetry. Uses four detection branches united into a single result set: (1) direct deletion of the Zone.Identifier NTFS ADS from files using FileDeleted events in DeviceFileEvents; (2) PowerShell Mount-DiskImage or Mount-VHD cmdlets used to attach ISO or virtual hard disk images; (3) process execution from non-standard drive letters (D–Z) via explorer.exe or cmd.exe, indicating execution from a mounted container image; and (4) use of streams.exe or PowerShell ADS manipulation (Remove-Item -Stream, Set-Content targeting Zone.Identifier) to strip or modify MOTW tags. The DetectionType field identifies which branch fired for rapid analyst triage.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators legitimately mounting Windows Server or application installer ISO files for software deployment via PowerShell scripting
- Virtual machine management software (VMware vCenter, Hyper-V Manager, VirtualBox) programmatically mounting VHD/VHDX files for VM provisioning or backup restoration
- Backup and recovery software (Veeam, Acronis, Macrium Reflect) that mounts disk images to facilitate granular file restoration
- Security administrators using Sysinternals streams.exe to audit alternate data streams on files during investigations or system hardening
- Developer workflows using Mount-DiskImage for application packaging pipelines, Docker Desktop disk image management, or WSL2 virtual hard disk operations
- CD/DVD ripping and burning software creating and locally mounting ISO images for verification prior to burning to physical media
Other platforms for T1553.005
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Mount ISO File and Execute Payload Without MOTW
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Mount-DiskImage' and the ISO path. System Event ID 6416 (Kernel-PnP): new virtual volume recognized. Sysmon Event ID 1: cmd.exe executing from a non-C: drive letter spawned by powershell.exe. Sysmon Event ID 11: motw-result.txt file creation in %TEMP%. Critically — no Sysmon Event ID 15 for Zone.Identifier on payload.bat inside the ISO, confirming MOTW bypass.
- Test 2Strip Zone.Identifier ADS via PowerShell Remove-Item -Stream
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Zone.Identifier' and 'Remove-Item'. Sysmon Event ID 15 (FileCreateStreamHash): fires during the setup phase when Zone.Identifier is written to the file. DeviceFileEvents (MDE) ActionType=FileDeleted targeting the Zone.Identifier stream. Windows Security Event ID 4663 (if object access auditing enabled): DELETE access to the file's ADS.
- Test 3Modify Zone.Identifier to ZoneId=0 (Amadey Technique)
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Zone.Identifier' and 'Set-Content'. Sysmon Event ID 15 (FileCreateStreamHash): fires twice — once for ZoneId=3 creation and once for the ZoneId=0 overwrite, producing different hash values for the stream content. DeviceFileEvents ActionType=FileModified for the test file. Key forensic indicator: Sysmon Event ID 15 with a hash value matching the ZoneId=0 template string '[ZoneTransfer]\r\nZoneId=0'.
- Test 4Delete Zone.Identifier Using Sysinternals Streams.exe
Expected signal: Sysmon Event ID 1: powershell.exe with Invoke-WebRequest downloading Streams.zip. Sysmon Event ID 3: network connection to download.sysinternals.com. Sysmon Event ID 11: Streams.zip and extracted files created in %TEMP%. Sysmon Event ID 1: streams64.exe process creation with CommandLine containing '-d' and the target file path. DeviceFileEvents: file modification event as Zone.Identifier ADS is deleted from the test file.
References (10)
- https://attack.mitre.org/techniques/T1553/005/
- https://web.archive.org/web/20201203131725/https://christiaanbeek.medium.com/investigating-the-use-of-vhd-files-by-cybercriminals-3f1f08304316
- https://outflank.nl/blog/2020/03/30/mark-of-the-web-from-a-red-teams-perspective/
- https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/
- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/6e3f7352-d11c-4d76-8c39-2516a9df36e8
- https://gist.github.com/wdormann/fca29e0dcda8b5c0472e73e10c78c3e7
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.005/T1553.005.md
- https://learn.microsoft.com/en-us/windows/win32/fileio/file-streams
- https://docs.microsoft.com/en-us/sysinternals/downloads/streams
- https://github.com/SwiftOnSecurity/sysmon-config
Unlock Pro Content
Get the full detection package for T1553.005 including response playbook, investigation guide, and atomic red team tests.