« Potential EDR-Freeze via WerFaultSecure Abuse Potential Data Exfiltration Through Curl »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.29

Mark-of-the-Web Removal by an Unusual Process

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Mark-of-the-Web Removal by an Unusual Process

edit

Identifies an unusual process deleting the Zone.Identifier alternate data stream from an executable or Windows Installer package. Attackers can remove this stream to bypass Mark-of-the-Web protections.

Rule type: eql

Rule indices:

  • logs-endpoint.events.file-*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • OS: Windows
  • Use Case: Threat Detection
  • Tactic: Defense Evasion
  • Resources: Investigation Guide
  • Data Source: Elastic Defend

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Mark-of-the-Web Removal by an Unusual Process

Possible investigation steps

  • Which process and account removed Mark-of-the-Web from which artifact?
  • Focus: Review file.path, process.executable, process.name, user.name, and host.name.
  • Implication: The alert establishes an attributed ADS deletion, not execution or intent. Treat a download, security, or deployment workflow as a benign candidate only when the exact remover, account, artifact, and an independent workflow record align.
  • Does the deleting-process context fit an expected unblocking workflow?
  • Focus: From related process events, review process.command_line, process.parent.executable, process.code_signature.subject_name, and process.code_signature.trusted.
  • Hint: When process.entity_id is populated, review events for the same process entity on the alert host !{investigate{"description":"","label":"Events for the deleting process on this host","providers":[[{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"process.entity_id","queryType":"phrase","value":"{{process.entity_id}}","valueType":"string"}]],"relativeFrom":"now-24h","relativeTo":"now"}}
  • Implication: PowerShell unblocking or deployment activity needs an expected parent, operator or task, command, and target artifact; a trusted signer alone is insufficient. If process.entity_id is absent, use host.id, process.pid, and a tight alert-time window; missing related process telemetry remains unresolved.
  • What provenance does the base executable or MSI have?
  • Focus: Strip the terminal :Zone.Identifier or :Zone.Identifier:$DATA suffix, then search same-host file events for the base path and inspect file.Ext.original.path, file.origin_url, file.origin_referrer_url, file.Ext.windows.zone_identifier, and file.hash.sha256 when populated.
  • Hint: Start with the 24 hours before the deletion and widen to available retention when necessary.
  • Implication: Missing download or file-origin telemetry is unresolved. Consistent source, hash, target directory, and a matching download or deployment record support the claimed workflow.
  • Was the base artifact executed or used in an installation attempt after deletion?
  • Focus: For an EXE, match the base path to process.executable; for an MSI, find msiexec.exe with the exact base path in process.args.
  • Hint: Search the same host for five minutes after the deletion, then widen when evidence warrants; review lineage and follow-on file or process activity.
  • Implication: A match establishes observed execution or an installation attempt, not maliciousness or installation success. Inconsistent provenance, lineage, or follow-on behavior supports escalation; no match only limits observed impact.
  • Is the removal isolated or repeated on the host?
  • Focus: Review deletions for the same ADS path !{investigate{"description":"","label":"File deletions for the same ADS path","providers":[[{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"event.category","queryType":"phrase","value":"file","valueType":"string"},{"excluded":false,"field":"file.path","queryType":"phrase","value":"{{file.path}}","valueType":"string"},{"excluded":false,"field":"event.type","queryType":"phrase","value":"deletion","valueType":"string"}]],"relativeFrom":"now-24h","relativeTo":"now"}}
  • Hint: When user.id is populated, review file deletions by the same user and process name, then retain only EXE or MSI Zone.Identifier paths !{investigate{"description":"","label":"File deletions by the same user and process name","providers":[[{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"event.category","queryType":"phrase","value":"file","valueType":"string"},{"excluded":false,"field":"user.id","queryType":"phrase","value":"{{user.id}}","valueType":"string"},{"excluded":false,"field":"process.name","queryType":"phrase","value":"{{process.name}}","valueType":"string"},{"excluded":false,"field":"event.type","queryType":"phrase","value":"deletion","valueType":"string"}]],"relativeFrom":"now-24h","relativeTo":"now"}}
  • Implication: If user.id is absent, use the exact-path results and a manual same-host search around the alert time. The broader transform returns all file deletions, not only MOTW removal; multiple unrelated matching artifacts support escalation, while a stable release set with the same expected workflow can support benign disposition.
  • Escalate when remover context, provenance, follow-on behavior, or repeated unrelated targets conflict with an expected workflow. Close only when alert telemetry and an independent download, deployment, or security-tool record align for the exact actor and artifact. Preserve evidence and escalate mixed or incomplete cases.

False positive analysis

  • Browser, download-handler, security-product, administrative, and deployment workflows can remove Mark-of-the-Web legitimately. Confirm that the process identity and lineage, account and host, exact artifact, provenance, and an independent product or deployment record describe the same workflow before closing the alert.
  • Add an exception only after recurring benign examples establish stable fields. Constrain it to alert fields such as the exact remover executable and signer, target path or package family, and expected account or host class; do not exclude PowerShell or all trusted processes globally.

Response and remediation

  • For unresolved activity, preserve the alert and source events, then recover the deleting-process and artifact context. Do not isolate a host solely on this low-severity signal.
  • If malicious activity or suspicious follow-on behavior is confirmed, contain affected hosts or accounts with reversible controls. Preserve volatile evidence when active or memory-resident behavior warrants it, then terminate malicious processes and quarantine artifacts or persistence after evidence review.
  • For confirmed benign activity, close the alert and consider a narrow exception only after recurring examples establish stable fields. Document affected paths, scope, observed workflow evidence, and telemetry gaps.

Setup

edit

Setup

This rule is designed for data generated by Elastic Defend, which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

Rule query

edit
file where host.os.type == "windows" and event.type == "deletion" and
  file.path : (
    "*.exe:Zone.Identifier",
    "*.exe:Zone.Identifier:$DATA",
    "*.msi:Zone.Identifier",
    "*.msi:Zone.Identifier:$DATA"
  ) and

  /* Explorer may remove MOTW after SmartScreen */
  not (
    process.executable : "?:\\Windows\\explorer.exe" and
    process.code_signature.trusted == true and
    process.code_signature.subject_name : "Microsoft Windows"
  )

Framework: MITRE ATT&CKTM

« Potential EDR-Freeze via WerFaultSecure Abuse Potential Data Exfiltration Through Curl »