T1553.005sub-technique of T1553 Subvert Trust Controls
Mark-of-the-Web Bypass
Windowsnothing on this site yetT1553.005 on attack.mitre.org
Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named `Zone.Identifier` with a specific value known as the MOTW. Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
how MITRE says to see it
Detect Mark-of-the-Web (MOTW) Bypass via Container and Disk Image Files
- Detects extraction or mounting of container/archive files (e.g.,.iso,.vhd,.zip) that originated from the Internet but whose contained files lack Zone.Identifier MOTW tagging. Correlates file creation metadata with subsequent execution of unsigned or untrusted binaries launched outside SmartScreen or Protected View.
what reduces it
- M1038 Execution Prevention. Consider blocking container file types at web and/or email gateways. Consider unregistering container file extensions in Windows File Explorer.
- M1042 Disable or Remove Feature or Program. Consider disabling auto-mounting of disk image files (i.e.,.iso,.img,.vhd, and.vhdx). This can be achieved by modifying the Registry values related to the Windows Explorer file associations in order to disable the automatic Explorer "Mount and Burn" dialog for these file extensions. Note: this will not deactivate the mount functionality itself.