PowerShell Mark-of-the-Web Bypass in ProgramData

Ethan Andrews@eandrews

•updated Feb 27, 2026•7•0•64

Detects PowerShell using the Unblock-File cmdlet to remove the Mark-of-the-Web (MotW) from a file located in the C:\ProgramData directory. This technique was observed in an APT36 campaign to allow a staged payload to execute without triggering Windows security warnings.