Which SIEM platforms have a T1553.005 detection rule?

df00tech provides T1553.005 (Mark-of-the-Web Bypass) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Mark-of-the-Web Bypass (T1553.005)?

Detecting Mark-of-the-Web Bypass requires the following data sources: File: File Deletion, File: File Modification, Process: Process Creation, Microsoft Defender for Endpoint.

What severity and confidence is the T1553.005 detection?

The T1553.005 detection is rated high severity with medium confidence.

What are common false positives for T1553.005?

Common false positives for T1553.005 include: IT administrators legitimately mounting Windows Server or application installer ISO files for software deployment via PowerShell scripting; Virtual machine management software (VMware vCenter, Hyper-V Manager, VirtualBox) programmatically mounting VHD/VHDX files for VM provisioning or backup restoration; Backup and recovery software (Veeam, Acronis, Macrium Reflect) that mounts disk images to facilitate granular file restoration.

T1553.005 Sumo Logic CSE · Sumo

Detect Mark-of-the-Web Bypass in Sumo Logic CSE

Adversaries abuse container file formats such as ISO disk images, VHD/VHDX virtual hard disks, and compressed archives (ZIP, RAR, 7z, ARJ) to deliver malicious payloads that bypass Mark-of-the-Web (MOTW) protections. When a container file is downloaded from the Internet, Windows tags it with a Zone.Identifier NTFS Alternate Data Stream (ZoneId=3), but files extracted or mounted from containers typically do not inherit this tag because MOTW is an NTFS feature and many container formats do not support NTFS ADS. This allows embedded executables, scripts, and LNK files to bypass Protected View in Microsoft Office, Windows Defender SmartScreen warnings, and other MOTW-dependent security controls. Adversaries also directly manipulate or delete the Zone.Identifier ADS from already-downloaded files (Amadey sets ZoneId=0; attackers use streams.exe or PowerShell Remove-Item -Stream). This technique has been widely adopted by TA505 (ISO/LNK chains), QakBot (ISO packaging), APT29 (ISO/VHDX embedded in HTML), and APT38 (ISO/VHD delivery).

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1553 Subvert Trust Controls
Sub-technique: T1553.005 Mark-of-the-Web Bypass
Canonical reference: https://attack.mitre.org/techniques/T1553/005/

Sumo Detection Query

Sumo Logic CSE (Sumo)

sql

// T1553.005 — MOTW Bypass Detection in Sumo Logic
// Covers ADS deletion, PowerShell mounting, ADS tool use, and mounted volume execution

(_sourceCategory="*windows*sysmon*" OR _sourceCategory="*WinEventLog*")
| parse field=_raw "<EventID>*</EventID>" as EventID nodrop
| parse field=_raw "<Data Name='Image'>*</Data>" as Image nodrop
| parse field=_raw "<Data Name='CommandLine'>*</Data>" as CommandLine nodrop
| parse field=_raw "<Data Name='ParentImage'>*</Data>" as ParentImage nodrop
| parse field=_raw "<Data Name='ParentCommandLine'>*</Data>" as ParentCommandLine nodrop
| parse field=_raw "<Data Name='TargetFilename'>*</Data>" as TargetFilename nodrop
| parse field=_raw "<Data Name='User'>*</Data>" as User nodrop
| parse field=_raw "<Data Name='Computer'>*</Data>" as Computer nodrop
| parse field=_raw "<Data Name='Hashes'>*</Data>" as Hashes nodrop
| where EventID in ("1", "15")
| eval ImageLower = toLowerCase(Image)
| eval CmdLower = toLowerCase(CommandLine)
| eval TargetLower = toLowerCase(TargetFilename)
| eval DetectionType = ""
// Branch 1: Sysmon FileCreateStreamHash (15) — Zone.Identifier ADS
| eval DetectionType = if (EventID = "15" AND matchesRegex(TargetLower, ".*:zone\.identifier$"), "Sysmon_ADS_Zone_Identifier", DetectionType)
// Branch 2: ADS Manipulation Tools
| eval DetectionType = if (
    EventID = "1" AND (
      matchesRegex(ImageLower, ".*streams(64)?\.exe$")
      OR (matchesRegex(ImageLower, ".*(powershell|pwsh)\.exe$") AND contains(CmdLower, "zone.identifier") AND (contains(CmdLower, "remove-item") OR contains(CmdLower, "-stream") OR contains(CmdLower, "clear-content") OR contains(CmdLower, "set-content")))
      OR (contains(ImageLower, "cmd.exe") AND contains(CmdLower, "zone.identifier"))
    ), "ADS_Manipulation_Tool", DetectionType)
// Branch 3: PowerShell Disk Image Mount
| eval DetectionType = if (
    EventID = "1"
    AND matchesRegex(ImageLower, ".*(powershell|pwsh)\.exe$")
    AND (contains(CmdLower, "mount-diskimage") OR contains(CmdLower, "mount-vhd")
         OR ((contains(CmdLower, ".iso") OR contains(CmdLower, ".vhd") OR contains(CmdLower, ".vhdx") OR contains(CmdLower, ".img"))
              AND (contains(CmdLower, "mount") OR contains(CmdLower, "attach") OR contains(CmdLower, "diskpart")))),
    "DiskImage_Mount_PowerShell", DetectionType)
// Branch 4: Execution from Mounted Volume
| eval DetectionType = if (
    EventID = "1"
    AND matchesRegex(Image, "^[D-Zd-z]:\\\\.*\\.(exe|dll|lnk|js|vbs|hta|bat|cmd|ps1|msi)$")
    AND (contains(toLowerCase(ParentImage), "explorer.exe") OR contains(toLowerCase(ParentImage), "cmd.exe"))
    AND NOT (contains(ImageLower, "program files") OR contains(ImageLower, "games") OR contains(ImageLower, "steam")),
    "Exec_From_Mounted_Volume", DetectionType)
| where DetectionType != ""
| fields - ImageLower, CmdLower, TargetLower
| table _messageTime, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, TargetFilename, Hashes, DetectionType
| sort by _messageTime desc

high severity medium confidence

Detects T1553.005 MOTW bypass in Sumo Logic using Sysmon operational events. Identifies Zone.Identifier ADS deletions (EventID 15), ADS manipulation via streams.exe or PowerShell, disk image mount commands, and suspicious process execution from non-system mounted drive letters.

Data Sources

Sumo Logic Cloud SIEMWindows Sysmon via Sumo Logic collectorWinEventLog source

Required Tables

_sourceCategory=*windows*sysmon*_sourceCategory=*WinEventLog*

False Positives & Tuning

Software deployment tools (SCCM, Intune, PDQ) mounting ISOs during provisioning workflows
IT staff using Sysinternals Streams.exe for legitimate ADS auditing or forensic investigations
Developers running portable applications or development environments from secondary volumes (D:, E:)
Backup or imaging software that mounts VHD/VHDX files as part of restore operations

Download portable Sigma rule (.yml)

Other platforms for T1553.005

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Mount ISO File and Execute Payload Without MOTW
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Mount-DiskImage' and the ISO path. System Event ID 6416 (Kernel-PnP): new virtual volume recognized. Sysmon Event ID 1: cmd.exe executing from a non-C: drive letter spawned by powershell.exe. Sysmon Event ID 11: motw-result.txt file creation in %TEMP%. Critically — no Sysmon Event ID 15 for Zone.Identifier on payload.bat inside the ISO, confirming MOTW bypass.
Test 2Strip Zone.Identifier ADS via PowerShell Remove-Item -Stream
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Zone.Identifier' and 'Remove-Item'. Sysmon Event ID 15 (FileCreateStreamHash): fires during the setup phase when Zone.Identifier is written to the file. DeviceFileEvents (MDE) ActionType=FileDeleted targeting the Zone.Identifier stream. Windows Security Event ID 4663 (if object access auditing enabled): DELETE access to the file's ADS.
Test 3Modify Zone.Identifier to ZoneId=0 (Amadey Technique)
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Zone.Identifier' and 'Set-Content'. Sysmon Event ID 15 (FileCreateStreamHash): fires twice — once for ZoneId=3 creation and once for the ZoneId=0 overwrite, producing different hash values for the stream content. DeviceFileEvents ActionType=FileModified for the test file. Key forensic indicator: Sysmon Event ID 15 with a hash value matching the ZoneId=0 template string '[ZoneTransfer]\r\nZoneId=0'.
Test 4Delete Zone.Identifier Using Sysinternals Streams.exe
Expected signal: Sysmon Event ID 1: powershell.exe with Invoke-WebRequest downloading Streams.zip. Sysmon Event ID 3: network connection to download.sysinternals.com. Sysmon Event ID 11: Streams.zip and extracted files created in %TEMP%. Sysmon Event ID 1: streams64.exe process creation with CommandLine containing '-d' and the target file path. DeviceFileEvents: file modification event as Zone.Identifier ADS is deleted from the test file.

Last updated: 2026-04-13 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1553.005 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Mark-of-the-Web Bypass in Sumo Logic CSE

MITRE ATT&CK

Sumo Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1553.005

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

Sumo Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1553.005

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox