ADS Zone.Identifier Deleted

Status: test
Severity: low
Log source: category file_delete, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects the deletion of the "Zone.Identifier" ADS. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Known false positives

Likely

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1070.004` Indicator Removal: File Deletion

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 23: FileDelete (File Delete archived)
Sysmon	Event ID 26: FileDeleteDetected (File Delete logged)

Rule body

title: ADS Zone.Identifier Deleted
id: 7eac0a16-5832-4e81-865f-0268a6d19e4b
related:
    - id: 3109530e-ab47-4cc6-a953-cac5ebcc93ae
      type: similar
status: test
description: Detects the deletion of the "Zone.Identifier" ADS. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.
references:
    - https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/
author: frack113
date: 2023-09-04
tags:
    - attack.stealth
    - attack.t1070.004
    - detection.threat-hunting
logsource:
    product: windows
    category: file_delete
detection:
    selection:
        TargetFilename|endswith: ':Zone.Identifier'
    condition: selection
falsepositives:
    - Likely
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetFilename|endswith: ':Zone.Identifier'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	ends_with	`:Zone.Identifier` corpus 6 (sigma 4, splunk 2)	`field:"TargetFilename" kind:ends_with value:":Zone.Identifier"`