Mark-of-the-Web Removal by an Unusual Process

[metadata]
creation_date = "2026/07/30"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/07/30"

[rule]
author = ["Elastic"]
description = """
Identifies an unusual process deleting the Zone.Identifier alternate data stream from an executable or Windows Installer
package. Attackers can remove this stream to bypass Mark-of-the-Web protections.
"""
false_positives = [
    "Browsers, download utilities, and security tools may remove Mark-of-the-Web during legitimate file handling.",
    "Administrative scripts and software deployment tools may intentionally unblock trusted executables or installers.",
]
from = "now-9m"
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Mark-of-the-Web Removal by an Unusual Process"
references = [
    "https://www.forcepoint.com/blog/x-labs/screenconnect-attack",
    "https://www.sonicwall.com/blog/living-off-legit-tools-stealthy-installation-of-remote-monitoring-agents-using-smartscreen-bypass",
    "https://any.run/cybersecurity-blog/rmm-blind-spot-for-cisos/",
    "https://www.cyfirma.com/research/apt36-multi-vector-execution-malware-campaign-targeting-indian-government-entities/"
]
risk_score = 21
rule_id = "757371cd-5e9e-4adb-bc4e-d81f0ad0ec4d"
setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "windows" and event.type == "deletion" and
  file.path : (
    "*.exe:Zone.Identifier",
    "*.exe:Zone.Identifier:$DATA",
    "*.msi:Zone.Identifier",
    "*.msi:Zone.Identifier:$DATA"
  ) and

  /* Explorer may remove MOTW after SmartScreen */
  not (
    process.executable : "?:\\Windows\\explorer.exe" and
    process.code_signature.trusted == true and
    process.code_signature.subject_name : "Microsoft Windows"
  )
'''

note = """## Triage and analysis

### Investigating Mark-of-the-Web Removal by an Unusual Process

#### Possible investigation steps

- Which process and account removed Mark-of-the-Web from which artifact?
  - Focus: Review `file.path`, `process.executable`, `process.name`, `user.name`, and `host.name`.
  - Implication: The alert establishes an attributed ADS deletion, not execution or intent. Treat a download, security, or deployment workflow as a benign candidate only when the exact remover, account, artifact, and an independent workflow record align.

- Does the deleting-process context fit an expected unblocking workflow?
  - Focus: From related process events, review `process.command_line`, `process.parent.executable`, `process.code_signature.subject_name`, and `process.code_signature.trusted`.
  - Hint: When `process.entity_id` is populated, review events for the same process entity on the alert host $investigate_0
  - Implication: PowerShell unblocking or deployment activity needs an expected parent, operator or task, command, and target artifact; a trusted signer alone is insufficient. If `process.entity_id` is absent, use `host.id`, `process.pid`, and a tight alert-time window; missing related process telemetry remains unresolved.

- What provenance does the base executable or MSI have?
  - Focus: Strip the terminal `:Zone.Identifier` or `:Zone.Identifier:$DATA` suffix, then search same-host file events for the base path and inspect `file.Ext.original.path`, `file.origin_url`, `file.origin_referrer_url`, `file.Ext.windows.zone_identifier`, and `file.hash.sha256` when populated.
  - Hint: Start with the 24 hours before the deletion and widen to available retention when necessary.
  - Implication: Missing download or file-origin telemetry is unresolved. Consistent source, hash, target directory, and a matching download or deployment record support the claimed workflow.

- Was the base artifact executed or used in an installation attempt after deletion?
  - Focus: For an EXE, match the base path to `process.executable`; for an MSI, find `msiexec.exe` with the exact base path in `process.args`.
  - Hint: Search the same host for five minutes after the deletion, then widen when evidence warrants; review lineage and follow-on file or process activity.
  - Implication: A match establishes observed execution or an installation attempt, not maliciousness or installation success. Inconsistent provenance, lineage, or follow-on behavior supports escalation; no match only limits observed impact.

- Is the removal isolated or repeated on the host?
  - Focus: Review deletions for the same ADS path $investigate_1
  - Hint: When `user.id` is populated, review file deletions by the same user and process name, then retain only EXE or MSI `Zone.Identifier` paths $investigate_2
  - Implication: If `user.id` is absent, use the exact-path results and a manual same-host search around the alert time. The broader transform returns all file deletions, not only MOTW removal; multiple unrelated matching artifacts support escalation, while a stable release set with the same expected workflow can support benign disposition.

- Escalate when remover context, provenance, follow-on behavior, or repeated unrelated targets conflict with an expected workflow. Close only when alert telemetry and an independent download, deployment, or security-tool record align for the exact actor and artifact. Preserve evidence and escalate mixed or incomplete cases.

### False positive analysis

- Browser, download-handler, security-product, administrative, and deployment workflows can remove Mark-of-the-Web legitimately. Confirm that the process identity and lineage, account and host, exact artifact, provenance, and an independent product or deployment record describe the same workflow before closing the alert.
- Add an exception only after recurring benign examples establish stable fields. Constrain it to alert fields such as the exact remover executable and signer, target path or package family, and expected account or host class; do not exclude PowerShell or all trusted processes globally.

### Response and remediation

- For unresolved activity, preserve the alert and source events, then recover the deleting-process and artifact context. Do not isolate a host solely on this low-severity signal.
- If malicious activity or suspicious follow-on behavior is confirmed, contain affected hosts or accounts with reversible controls. Preserve volatile evidence when active or memory-resident behavior warrants it, then terminate malicious processes and quarantine artifacts or persistence after evidence review.
- For confirmed benign activity, close the alert and consider a narrow exception only after recurring examples establish stable fields. Document affected paths, scope, observed workflow evidence, and telemetry gaps.
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.type",
    "file.extension",
    "file.name",
    "file.path",
    "host.id",
    "host.name",
    "process.code_signature.subject_name",
    "process.code_signature.trusted",
    "process.entity_id",
    "process.executable",
    "process.name",
    "process.pid",
    "user.domain",
    "user.id",
    "user.name",
]


[[transform.investigate]]
label = "Events for the deleting process on this host"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
  ]
]
relativeFrom = "now-24h"
relativeTo = "now"

[[transform.investigate]]
label = "File deletions for the same ADS path"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
    { excluded = false, field = "file.path", queryType = "phrase", value = "{{file.path}}", valueType = "string" },
    { excluded = false, field = "event.type", queryType = "phrase", value = "deletion", valueType = "string" }
  ]
]
relativeFrom = "now-24h"
relativeTo = "now"

[[transform.investigate]]
label = "File deletions by the same user and process name"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" },
    { excluded = false, field = "process.name", queryType = "phrase", value = "{{process.name}}", valueType = "string" },
    { excluded = false, field = "event.type", queryType = "phrase", value = "deletion", valueType = "string" }
  ]
]
relativeFrom = "now-24h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1553"
name = "Subvert Trust Controls"
reference = "https://attack.mitre.org/techniques/T1553/"
[[rule.threat.technique.subtechnique]]
id = "T1553.005"
name = "Mark-of-the-Web Bypass"
reference = "https://attack.mitre.org/techniques/T1553/005/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"