MSI Execution Following Zone.Identifier ADS Removal (MOTW Bypass)

Ethan Andrews@eandrews

•updated Aug 4, 2026•0•0•6

Detects the deletion of the 'Zone.Identifier' alternate data stream from a downloaded .msi file, followed closely by the execution of that file using 'msiexec.exe'. This pattern is a known technique for bypassing Windows Mark-of-the-Web (MOTW) protections, which normally trigger SmartScreen warnings or Restricted View protections for internet-downloaded files.