T1553.005Defense Impairment
Mark-of-the-Web Bypass
Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW. Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a…
CVEs11
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.11
Reports1
Detections
6 Sigma rules tagged T1553.005Mark-of-the-Web BypassT1553.0056 general rules
- Suspicious Invoke-Item From Mount-DiskImagemediumtest
- Suspicious Unblock-Filemediumtest
- Windows AppX Deployment Full Trust Package Installationmediumexperimental
- Windows AppX Deployment Unsigned Package Installationmediumexperimental
- Suspicious Mount-DiskImagelowtest
- Windows MSIX Package Support Framework AI_STUBS Executionlowexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Mark-of-the-Web Bypass
11 CVEs, by priority. Each link shows its badge.- CVE-2024-21412Microsoft Windows Internet Shortcut Files Security Feature Bypass VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 8.1T1204.001Malicious LinkT1553.005Mark-of-the-Web Bypass1 reportAI mapping from the description · primary impact99.4%Top 0.06%82.5priority
- CVE-2023-36884Microsoft Windows Search Remote Code Execution VulnerabilityMITRE CTID mapping of the KEV entry · follow-on activity99.4%Top 0.06%78.2priority
- CVE-2023-24880Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityAI mapping from the description · primary impact78.0%Top 0.43%71.0priority
- CVE-2025-04117-Zip Mark of the Web Bypass VulnerabilityMITRE CTID mapping of the KEV entry · how it is exploited67.1%Top 0.7%67.8priority
- CVE-2022-41091Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityAI mapping from the description · primary impact1.9%Top 20%67.7priority
- CVE-2024-38217Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure VulnerabilityAI mapping from the description · how it is exploited10.0%Top 4.4%65.9priority
- CVE-2024-21351Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityAI mapping from the description · primary impact27.8%Top 1.9%62.9priority
- CVE-2023-32049Microsoft Windows Defender SmartScreen Security Feature Bypass VulnerabilityAI mapping from the description · primary impact4.2%Top 9.1%62.3priority
- CVE-2024-38213Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityAI mapping from the description · how it is exploited13.6%Top 3.5%61.8priority
- CVE-2023-36584Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityAI mapping from the description · primary impact3.3%Top 12%59.4priority
- CVE-2022-41049Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityAI mapping from the description · primary impact2.6%Top 14%58.9priority