PowerShell Zone.Identifier ADS Removal to Suppress MOTW/SmartScreen

Ibrahim Saud@tektrix

•updated 14 days ago•2•0•3

Detects the use of PowerShell to remove the 'Zone.Identifier' NTFS Alternate Data Stream (ADS) from files. This stream is responsible for the 'Mark-of-the-Web' (MOTW) which triggers security warnings in Windows, including SmartScreen and Protected View. Adversaries use this technique to evade security controls on downloaded malicious files.