Detection Strategies DET0257 — Detect Mark-of-the-Web (MOTW) Bypass via Container and Disk Image Files

DET0257

Detect Mark-of-the-Web (MOTW) Bypass via Container and Disk Image Files

1 analytic(s) · 1 technique(s) detected

Analytics

AN0712 Analytic 0712

Windows

Detects extraction or mounting of container/archive files (e.g., .iso, .vhd, .zip) that originated from the Internet but whose contained files lack Zone.Identifier MOTW tagging. Correlates file creation metadata with subsequent execution of unsigned or untrusted binaries launched outside SmartScreen or Protected View.

WinEventLog:Security EventCode=4663, 4670, 4656 WinEventLog:Sysmon EventCode=11 WinEventLog:Sysmon EventCode=15

[WatchedExtensions] Adjust monitored file types (e.g., .iso, .vhd, .zip, .gz, .rar) based on enterprise usage

[TimeWindow] Defines correlation window between extraction/mount and first execution of inner files

[TrustedExtractionTools] Whitelist known enterprise archivers and deployment mechanisms to reduce false positives

Detected Techniques

Defense Impairment (1)

T1553.005 Mark-of-the-Web Bypass

Details

MITRE ID: DET0257
STIX ID: x-mitre-detection-strategy--2556841e-474a-45c0-b827-4f5db6dcca31
Analytics: 1
Techniques Detected: 1
By Tactic