Mark of the Web (MoTW) is a Windows feature that identifies files downloaded from the Internet and displays a security warning, as well as restricts the files to be executed with a warning message or in a protected mode. However, threat actors have been bypassing Mark of the Web (MoTW) in various ways, utilizing these methods during their initial access or malware distribution. This post will cover the basic concepts and components of Mark of the Web (MoTW), as well as its main vulnerabilities and exploitation cases.

Quote:What Is Mark Of The Web?

Mark of the Web (MoTW) is a security feature of the Microsoft Windows operating system that adds an NTFS Alternate Data Stream (ADS) called “Zone.Identifier” to files downloaded from the Internet, indicating the file’s source. This feature displays a security warning or restricts the file from being executed when a user tries to run a file downloaded from the Internet.

Files with Mark of the Web (MoTW) have the following characteristics:
 

• Microsoft Office document: Opened in Protected View mode
  
• Executable file (.exe, .dll): Windows SmartScreen warning
  
• Script file (.js, .vbs, .ps1): Warning or block message when executed
  

Full Article_Mark of the Web (MoTW) Bypass Vulnerability

ASEC (AhnLab SEcurity intelligence Center)


Data and info derived from AhnLab with permission