MOTW Bypass via Zone.Identifier Removal
This rule detects attempts to bypass the Mark-of-the-Web (MOTW) security feature by removing or altering the Zone.Identifier stream from downloaded files. Specifically, it looks for HTTP traffic (flow:to_client,established) containing both 'Zone.Identifier' and 'ZoneId=3' (which typically indicates an internet zone download) in the file data, suggesting an attempt to strip this metadata during transit to prevent security warnings or restrictions on the client side. This technique is often used by attackers to make malicious files appear less suspicious.
Suricata
