ADS Zone.Identifier Deleted

testlow

log source: windows · file_deleteauthor frack113date 2023-09-04

description

What this is, in brief.

Detects the deletion of the "Zone.Identifier" ADS. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

rule source (YAML)

title: ADS Zone.Identifier Deleted
id: 7eac0a16-5832-4e81-865f-0268a6d19e4b
related:
    - id: 3109530e-ab47-4cc6-a953-cac5ebcc93ae
      type: similar
status: test
description: Detects the deletion of the "Zone.Identifier" ADS. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.
references:
    - https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/
author: frack113
date: 2023-09-04
tags:
    - attack.stealth
    - attack.t1070.004
    - detection.threat-hunting
logsource:
    product: windows
    category: file_delete
detection:
    selection:
        TargetFilename|endswith: ':Zone.Identifier'
    condition: selection
falsepositives:
    - Likely
level: low

detects techniques (1)

ATT&CK techniques this enables or maps to.

T1070.004File Deletion

references

External citations — patches, advisories, analysis.

https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/