Phorpiex Mark Of The Web Evasion

Tim Peck@timpeck

•updated Dec 17, 2025•2•0•47

Detects the deletion of the ':Zone.Identifier' Alternate Data Stream (ADS) from a file. This is a technique used by malware like Phorpiex to remove the Mark-of-the-Web and bypass security warnings on downloaded files.