Windows marks files that come from the internet, and that mark drives some of its best warnings. MITRE ATT&CK technique T1553.005, Mark-of-the-Web Bypass, covers abusing file formats so the mark never reaches the file that matters. The tactic is defense impairment and the platform is Windows.
How attackers use it
When a file is downloaded, Windows tags it with a hidden NTFS Alternate Data Stream named Zone.Identifier. The value is known as the Mark-of-the-Web, or MOTW. Tagged files are restricted in useful ways. An Office file with the MOTW opens in Protected View. An executable with the MOTW is processed by Windows Defender SmartScreen, which compares it with an allowlist of well-known executables. If the file is not known or trusted, SmartScreen blocks execution and warns the user.
The weakness MITRE documents is containers. Adversaries may deliver payloads in compressed or archive formats such as .arj and .gzip, or in disk images such as .iso and .vhd. The container itself is marked when downloaded. The files inside may not inherit the mark when the container is extracted or mounted, because MOTW is an NTFS feature and many container formats do not support alternate data streams. Once extracted or mounted, the contents can be treated as ordinary local files and run without those protections.
How to detect it
MITRE lists no data sources on this page. Practical signals:
- Disk image mounts. A user mounting an .iso, .img, .vhd or .vhdx that arrived from a browser or email.
- Execution from new drive letters. Processes launching from a freshly mounted virtual drive.
- Missing marks. Executables in user download or temp paths with no
Zone.Identifierstream, when the same kind of file normally has one. - Stream creation events. Sysmon event 15 records creation of file streams, which lets you see which files received a Zone.Identifier and which did not.
How to reduce the risk
MITRE lists two mitigations.
- Disable or remove the feature. Consider disabling auto-mounting of disk image files (.iso, .img, .vhd and .vhdx). This is done by modifying registry values for the Windows Explorer file associations, to turn off the automatic "Mount and Burn" dialog for those extensions. MITRE notes this does not deactivate the mount function itself.
- Execution prevention. Consider blocking container file types at web and email gateways, and unregistering container file extensions in Windows File Explorer.
If your teams do not need disk images from the internet, blocking them at the gateway is the cleanest fix. If they do, route those downloads through a sandbox or a scanning step first.
Check your own environment
# PowerShell: does a downloaded file carry the Mark-of-the-Web?
Get-Content -Path "C:\path\to\file.exe" -Stream Zone.Identifier
# List files that have the stream, in the Downloads folder
Get-ChildItem "$env:USERPROFILE\Downloads" -Recurse -File | Where-Object { Get-Item $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue }
Also review your mail and web gateway rules and ask whether .iso, .img, .vhd, .vhdx and .arj attachments are blocked or allowed.
Quick check
Why can an executable inside a mounted ISO run without SmartScreen checks?
The ISO itself is marked, but the files inside may not inherit the Mark-of-the-Web, since container formats often do not support NTFS alternate data streams. They are then treated as local files.
