What is Mark of the Web?
Mark of the Web (MotW) is how Windows remembers that a file came from the internet or another untrusted place. When a browser downloads a file, or an email client saves an attachment, it writes a small hidden NTFS alternate data stream named Zone.Identifier alongside the file's normal contents. Later, when someone opens the file, Windows and applications read that stream and treat the file with more suspicion than one created on the machine.
What the mark contains
You can read the stream in PowerShell:
Get-Content .\invoice.docx -Stream Zone.Identifier
The output is a short block of text: a [ZoneTransfer] line, then ZoneId=3, often followed by ReferrerUrl and HostUrl lines that record where the file came from. The zone numbers are the Windows security zones that Internet Explorer made familiar: 0 is the local computer, 1 the local intranet, 2 trusted sites, 3 the internet and 4 restricted sites. A file marked with zone 3 or 4 gets the extra protections. A user can remove the mark with the Unblock checkbox in the file's properties, and PowerShell's Unblock-File does the same.
What MotW triggers
- SmartScreen: Microsoft Defender SmartScreen checks the reputation of marked programs and warns about unrecognized or unsigned ones.
- Protected View: Office opens marked documents read-only in a sandbox until the user chooses to enable editing.
- Macro blocking: since 2022, Office blocks VBA macros in files from the internet by default and shows a security risk banner instead of an Enable Content button.
- Security prompts: Windows shows an Open File - Security Warning dialog before running marked executables.
How attackers get around it
Because MotW blocked so much commodity malware, attackers worked on avoiding or stripping it:
- Container files: once Office blocked internet macros, campaigns moved to ISO, IMG and VHD disk images and some archive formats, because files inside them did not inherit the mark. Microsoft closed the disk-image gap with an update in late 2022, and many archive tools now copy the mark to extracted files.
- File systems without streams: FAT32 and exFAT have no alternate data streams, so copying a file to such a drive silently drops the mark.
- Social engineering: instructions that tell the user to click Unblock or to run a command themselves.
- Bypass flaws: Microsoft has patched several vulnerabilities that let crafted files skip MotW checks, some of them exploited before the fix.
Mark of the Web vs. related controls
- Code signing proves who published a file; MotW records where the copy came from. SmartScreen uses both.
- Sandboxing opens or runs content in isolation; Protected View is a sandbox that MotW switches on.
- Attachment scanning at the mail gateway inspects files before delivery; MotW works on the endpoint after delivery.
- macOS Gatekeeper plays a similar role, using a quarantine attribute that macOS attaches to downloaded files.
Mark of the Web on the CompTIA Security+ exam
In SY0-801, Mark of the Web comes up as a defense for the attachment-based threat vectors in objective 2.3, where documents with macros, RTF files and PDFs arrive by email or download and opening internet-sourced files in a restricted mode is the countermeasure. A scenario in which a downloaded document opens with a warning and its text urges the user to "enable content" is testing whether you know that blocking macros in files from the internet is the right control. Distractors include user training on its own, a mail gateway rule, which acts before delivery, and code signing, which identifies a publisher rather than a file's origin.