Skip to content

Hide Navigation Hide TOC

Suspicious Unblock-File (5947497f-1aa4-41dd-9693-c9848d58727d)

Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.

Cluster A Galaxy A Cluster B Galaxy B Level
Suspicious Unblock-File (5947497f-1aa4-41dd-9693-c9848d58727d) Sigma-Rules Mark-of-the-Web Bypass - T1553.005 (7e7c2fba-7cca-486c-9582-4c1bb2851961) Attack Pattern 1
Subvert Trust Controls - T1553 (b83e166d-13d7-4b52-8677-dff90c548fd7) Attack Pattern Mark-of-the-Web Bypass - T1553.005 (7e7c2fba-7cca-486c-9582-4c1bb2851961) Attack Pattern 2