huntrule

Windows: Deletion of Zone.Identifier Alternate Data Stream

Alerts on Windows deletions of the Zone.Identifier ADS, which attackers may remove to evade zone-based security controls.

FreeUnreviewedSigmalowv1
title: "Windows: Deletion of Zone.Identifier Alternate Data Stream"
id: e177bbdb-3e9e-40cb-b1e2-5766ae9bb5d4
related:
  - id: 3109530e-ab47-4cc6-a953-cac5ebcc93ae
    type: similar
  - id: 7eac0a16-5832-4e81-865f-0268a6d19e4b
    type: derived
status: test
description: This rule flags Windows file deletions where the target filename ends with ':Zone.Identifier', indicating the removal of the Zone.Identifier Alternate Data Stream. Attackers may delete this ADS to reduce or circumvent security controls that rely on Zone.Identifier markings. The detection relies on Windows file deletion telemetry that includes the full target filename/path.
references:
  - https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_delete/file_delete_win_zone_identifier_ads.yml
author: frack113, Huntrule Team
date: 2023-09-04
tags:
  - attack.stealth
  - attack.t1070.004
  - detection.threat-hunting
logsource:
  product: windows
  category: file_delete
detection:
  selection:
    TargetFilename|endswith: :Zone.Identifier
  condition: selection
falsepositives:
  - Likely
level: low
license: DRL-1.1

What it detects

This rule flags Windows file deletions where the target filename ends with ':Zone.Identifier', indicating the removal of the Zone.Identifier Alternate Data Stream. Attackers may delete this ADS to reduce or circumvent security controls that rely on Zone.Identifier markings. The detection relies on Windows file deletion telemetry that includes the full target filename/path.

Known false positives

  • Likely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.