PowerShell Zone.Identifier ADS Removal

wakasa smoky@wakasadb3

•updated Apr 3, 2026•14•0•98

Detects the execution of PowerShell commands using the Remove-Item cmdlet to explicitly target and delete the :Zone.Identifier Alternate Data Stream (ADS). This technique is commonly used by adversaries to evade Mark-of-the-Web (MOTW) detection and make downloaded malicious files appear less suspicious.