PowerShell Unblock-File in ProgramData for MotW Bypass

nomit vyas@xoxo

•updated Feb 28, 2026•6•0•75

Detects PowerShell using the Unblock-File cmdlet to remove the Mark-of-the-Web (MotW) from a file located in the C:\ProgramData directory. This technique was observed in an APT36 campaign to allow a staged payload to execute without triggering Windows security warnings.