Zone.Identifier

The Zone.Identifier alternate data stream (ADS) is a core component of Windows' Mark of the Web (MotW) security framework. When a file is downloaded from the Internet, Windows tags it with a hidden NTFS ADS named Zone.Identifier containing metadata about the file's origin. This tag is used by the operating system, Microsoft Office, SmartScreen, and other security features to warn users before opening potentially dangerous files. For forensic analysts, Zone.Identifier provides direct evidence that a file was downloaded from an external source and can reveal where it came from.

How It Works

When a file is downloaded through a MotW-aware application, the Windows API function IAttachmentExecute writes a Zone.Identifier ADS to the file. This ADS is only preserved on NTFS volumes. Files moved to FAT32, exFAT, or network shares using non-NTFS file systems will lose the stream.

The Zone.Identifier stream is a plain-text INI-style file containing a [ZoneTransfer] section with one or more of the following fields:

[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://example.com/downloads
HostUrl=https://cdn.example.com/file.exe

ZoneId Values

ZoneId	Zone Name	Description
0	MyComputer	File originated from the local machine
1	Intranet	File originated from the local intranet
2	Trusted	File originated from a trusted site
3	Internet	File originated from the Internet (most common for downloads)
4	Untrusted	File was flagged as suspicious (e.g., by Microsoft SmartScreen)

ZoneId=3 is by far the most common value encountered during investigations and indicates a standard Internet download.

Additional Fields

• ReferrerUrl: The URL of the page that initiated the download. This can reveal the website the user was visiting when the download occurred.

• HostUrl: The direct URL from which the file was downloaded. This is useful for tracing the exact source of a payload.

• HostIpAddress: In some cases, the IP address of the download host is recorded (primarily seen with downloads via Edge).

Not all applications populate all fields. The presence and completeness of these fields varies by browser and download method.

Application Support

Applications That Set MotW

• Modern browsers: Microsoft Edge, Google Chrome, and Mozilla Firefox all tag downloaded files with Zone.Identifier. Edge and Chrome tend to populate both ReferrerUrl and HostUrl. Firefox populates ReferrerUrl but may not always include HostUrl.

• Email clients: Outlook tags attachments saved to disk.

• Windows built-in: Files downloaded via Windows Explorer (e.g., from network shares mapped to Internet zone).

Applications That Do NOT Set MotW

• Command-line tools: curl.exe, wget, bitsadmin, PowerShell's Invoke-WebRequest / Invoke-RestMethod, and ftp.exe do not apply the Zone.Identifier ADS by default. This is a critical gap. If an attacker downloads a payload using these tools, the file will lack MotW and will not trigger SmartScreen warnings.

• Some third-party download managers and torrent clients may not apply MotW.

• Git clone operations do not apply MotW to cloned files.

Forensic Implication: The absence of a Zone.Identifier on a file that appears to have been downloaded can itself be an indicator. It may suggest the file was downloaded via a command-line tool, extracted from a container format that stripped MotW, or had its ADS deliberately removed.

MotW Bypass Techniques (MITRE ATT&CK T1553.005)

MotW bypasses are actively exploited in the wild and are directly relevant to DFIR investigations. Understanding these techniques helps explain why a downloaded malicious file may lack a Zone.Identifier or why SmartScreen did not trigger.

Container Format Bypasses

Certain container file formats do not properly propagate MotW to their contents when extracted:

• ISO / IMG files: When a user mounts an ISO or IMG file, the files inside are accessed via a virtual drive and do not inherit MotW. This technique has been heavily abused since Microsoft disabled Office macros by default for Internet-sourced documents in 2022. Threat actors commonly deliver malicious payloads inside ISO files attached to phishing emails.

• VHD / VHDX files: Same behavior as ISO files. Mounting a VHD bypasses MotW for files inside.

• CAB files: In some configurations, extracting CAB files does not propagate MotW.

Archive Tool Vulnerabilities

• CVE-2025-0411 (7-Zip): Versions before 24.09 did not propagate MotW to files within double-compressed archives (an archive inside an archive). Exploited as a zero-day by Russian threat actors against Ukrainian targets using SmokeLoader.

• CVE-2024-8811 / CVE-2025-33028 (WinZip): WinZip 29.x and earlier failed to propagate MotW to extracted files.

• CVE-2024-38217: A Windows vulnerability allowing MotW bypass through specially crafted archive files.

• CVE-2024-38213: Exploited by DarkGate operators to bypass SmartScreen using MotW manipulation.

• CVE-2022-41091 / CVE-2022-44698: Earlier MotW bypass vulnerabilities in Windows itself.

Deliberate MotW Removal

The Zone.Identifier ADS can be stripped from a file through built-in Windows mechanisms, third-party tools, or by directly deleting the alternate data stream. Once removed, it cannot be recovered unless a backup or forensic image preserved the original ADS. The absence of MotW on a file you expect to have been downloaded should be treated as suspicious and investigated further.

Analyzing the Artifact

Reading Zone.Identifier on a Live System

# PowerShell - read the ADS contents
Get-Content -Path "C:\Users\user\Downloads\file.exe" -Stream Zone.Identifier

# PowerShell - list all files with Zone.Identifier in a directory
Get-ChildItem -Path "C:\Users\user\Downloads" -Recurse |
    ForEach-Object { Get-Item $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue } |
    Select-Object FileName

# Command line - using notepad to view the ADS
notepad "C:\Users\user\Downloads\file.exe:Zone.Identifier"

# Using more
more < "C:\Users\user\Downloads\file.exe:Zone.Identifier"

Forensic Image Analysis

• MFTECmd (Eric Zimmerman): Parse the MFT to identify files with alternate data streams, including Zone.Identifier. This can reveal downloaded files even in unexpected locations like C:\Windows\System32 or temp directories.

• FTK Imager: View ADS contents directly from a forensic image.

• The Sleuth Kit (TSK): Use fls to list files with ADS, istat to view ADS details for a specific MFT entry, and icat to extract the ADS contents.

• Velociraptor: The Windows.NTFS.ADSHunter artifact can scan for and collect Zone.Identifier streams across a system.

• Windows Sysinternals Streams: streams.exe -s C:\Users recursively lists all files with ADS.

What to Look For

During an investigation, focus on:

• Files with ZoneId=3 or ZoneId=4 in sensitive directories (System32, ProgramData, temp folders, user profile root).

• HostUrl or ReferrerUrl values pointing to suspicious domains, IP addresses, paste sites, file-sharing services, or CDN URLs commonly abused for payload hosting.

• Downloaded executables, scripts (.ps1, .vbs, .js, .hta, .wsf), or Office documents with macros.

• The absence of Zone.Identifier on files that contextual evidence (browser history, Prefetch, proxy logs) suggests were downloaded. This may indicate a MotW bypass or command-line download tool was used.

Artifact Correlation

• Browser History: Correlate HostUrl/ReferrerUrl from Zone.Identifier with browser download records to build a complete picture of the download chain.

• Prefetch / Amcache: Determine if a downloaded executable was subsequently executed.

• $MFT / $UsnJrnl: Timeline file creation events alongside Zone.Identifier data to establish when files arrived on the system.

• Email Headers / Attachments: For files saved from email, correlate with email artifacts to identify the sender and delivery path.

• Proxy / Firewall Logs: Match HostUrl values against network logs for additional context.

References

• MITRE ATT&CK T1553.005 - Mark-of-the-Web Bypass

• Red Canary: Mark of the Web Bypass

• Microsoft: IAttachmentExecute Interface

• BleepingComputer: 7-Zip MotW bypass exploited in zero-day attacks