T1553.005 — Mark-of-the-Web Bypass

Tactic: Defense Impairment · Platforms: Windows

Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW. Files that are tagged with…

Sub-technique of Subvert Trust Controls (T1553).

Sigma detection rules (1)

T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass

title: "T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass"
id: 9a8114c9-a354-42c4-8d64-cf1d6e771edc
description: 'Detect MOTW Bypass via Container and Disk Image Files. Targets creation of container/disk-image files (.iso/.img/.vhd/.vhdx/.udf), the delivery vector used to smuggle MOTW-unaware payloads. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: WatchedExtensions, TimeWindow, TrustedExtractionTools.'
references:
  - https://attack.mitre.org/techniques/T1553/005
author: Shahrukh Khan
date: 2026-01-03
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1553.005

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|endswith:
      - '.iso'
      - '.img'
      - '.vhd'
      - '.vhdx'
      - '.udf'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Legitimate software deployment, OS imaging, or virtualization workflows.

level: medium

Related sub-techniques

Explore