{"id":"3109530e-ab47-4cc6-a953-cac5ebcc93ae","title":"ADS Zone.Identifier Deleted By Uncommon Application","description":"Detects the deletion of the \"Zone.Identifier\" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-09-04","modified":"2025-07-04","tags":["attack.stealth","attack.t1070.004"],"technique_ids":["T1070.004"],"logsource":{"product":"windows","category":"file_delete"},"falsepositives":["Other third party applications not listed."],"references":["https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/","Internal Research"],"source_path":"rules/windows/file/file_delete/file_delete_win_zone_identifier_ads_uncommon.yml","source_sha256":"f09a08d11b0e1e903922eee808530b018463e7ceb73fff643c0abdc3043a1af1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_delete/file_delete_win_zone_identifier_ads_uncommon.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ADS Zone.Identifier Deleted By Uncommon Application\nid: 3109530e-ab47-4cc6-a953-cac5ebcc93ae\nrelated:\n    - id: 7eac0a16-5832-4e81-865f-0268a6d19e4b\n      type: similar\nstatus: test\ndescription: Detects the deletion of the \"Zone.Identifier\" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.\nreferences:\n    - https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/\n    - Internal Research\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-09-04\nmodified: 2025-07-04\ntags:\n    - attack.stealth\n    - attack.t1070.004\nlogsource:\n    product: windows\n    category: file_delete\ndetection:\n    selection:\n        TargetFilename|endswith: ':Zone.Identifier'\n    filter_main_generic:\n        # Note: in some envs this activity might be performed by other software. Apply additional filters as necessary\n        Image:\n            - 'C:\\Program Files\\PowerShell\\7-preview\\pwsh.exe'\n            - 'C:\\Program Files\\PowerShell\\7\\pwsh.exe'\n            - 'C:\\Windows\\explorer.exe'\n            - 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - 'C:\\Windows\\SysWOW64\\explorer.exe'\n            - 'C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe'\n    filter_optional_browsers_chrome:\n        Image:\n            - 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'\n            - 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'\n    filter_optional_browsers_firefox:\n        Image:\n            - 'C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe'\n            - 'C:\\Program Files\\Mozilla Firefox\\firefox.exe'\n    filter_optional_browsers_msedge:\n        Image:\n            - 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'\n            - 'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Other third party applications not listed.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1070.004","id":"T1070.004","name":"File Deletion","page":"techniques/enterprise/T1070.004/"}],"data_path":"data/detection-rules/3109530e-ab47-4cc6-a953-cac5ebcc93ae.json","kind":"sigma"}