PowerShell: Unblock-File attempts to remove Zone.Identifier ADS

title: "PowerShell: Unblock-File attempts to remove Zone.Identifier ADS"
id: 80aac208-ee81-41f4-85a4-493ed16d2381
status: test
description: This rule flags PowerShell script block text containing the Unblock-File cmdlet with a -Path argument, which is used to remove the Zone.Identifier alternate data stream that marks files as downloaded from the internet. Attackers may use this to impair security controls that rely on this metadata, such as download-origin checks and execution prompts. The detection relies on Script Block Logging telemetry that captures the executed PowerShell script content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-3---remove-the-zoneidentifier-alternate-data-stream
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7.2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_unblock_file.yml
author: frack113, Huntrule Team
date: 2022-02-01
tags:
  - attack.defense-impairment
  - attack.t1553.005
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "Unblock-File "
      - "-Path "
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: medium
license: DRL-1.1
related:
  - id: 5947497f-1aa4-41dd-9693-c9848d58727d
    type: derived