T1553.005
Subvert Trust Controls: Mark-of-the-Web Bypass
discovered 2026-06-17Writes a fake Zone.Identifier alternate data stream with ZoneId=0 to the dropped .exe to strip Mark-of-the-Web and defeat SmartScreen.
View on MITRE ATT&CKWrites a fake Zone.Identifier alternate data stream with ZoneId=0 to the dropped .exe to strip Mark-of-the-Web and defeat SmartScreen.
View on MITRE ATT&CKSafeDep keeps analytics anonymous and cookie-free until you opt in. Accepting helps us understand product usage and improve your experience. Privacy Policy
Choose what you share. You can change this anytime from the footer.
