Técnica MITRE ATT&CK · defense-impairment

`T1553.005` Mark-of-the-Web Bypass

Subtécnica de T1553 Subvert Trust Controls

Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For…

Ficha en MITRE ATT&CK ↗

Quién la usa · con noticias en Jábega

Amadey

Reglas Sigma para cazarla

Suspicious Invoke-Item From Mount-DiskImagemediumtest · windows
Suspicious Unblock-Filemediumtest · windows
Windows AppX Deployment Full Trust Package Installationmediumexperimental · windows
Windows AppX Deployment Unsigned Package Installationmediumexperimental · windows

Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.