Deletion of Zone.Identifier Alternate Data Stream

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects the deletion of the "Zone.Identifier" Alternate Data Stream (ADS). Attackers can leverage this to bypass security restrictions that make use of the ADS, such as those in Microsoft Office applications. By removing this identifier, a file downloaded from the internet might be treated as a local file, potentially allowing macros or other active content to run without security warnings.