LoFP LoFP / browsers, download utilities, and security tools may remove mark-of-the-web during legitimate file handling.

Techniques

Sample rules

Mark-of-the-Web Removal by an Unusual Process

Description

Identifies an unusual process deleting the Zone.Identifier alternate data stream from an executable or Windows Installer package. Attackers can remove this stream to bypass Mark-of-the-Web protections.

Detection logic

file where host.os.type == "windows" and event.type == "deletion" and
  file.path : (
    "*.exe:Zone.Identifier",
    "*.exe:Zone.Identifier:$DATA",
    "*.msi:Zone.Identifier",
    "*.msi:Zone.Identifier:$DATA"
  ) and

  /* Explorer may remove MOTW after SmartScreen */
  not (
    process.executable : "?:\\Windows\\explorer.exe" and
    process.code_signature.trusted == true and
    process.code_signature.subject_name : "Microsoft Windows"
  )