ADS Zone.Identifier Deleted By Uncommon Application

SigmaHQ Detections@sigmaHQ

•updated Jul 8, 2025•2•0•31

Detects the deletion of the "Zone.Identifier" Alternate Data Stream (ADS) by an uncommon process. Attackers can leverage this to bypass security restrictions that rely on the ADS, such as those in Microsoft Office applications, which use the Mark-of-the-Web (MOTW) to flag files downloaded from the internet.