The Mark Of The Web
Source: YouTube · John Hammond · published Aug 21, 2024 · 27:48
The mark of the web is a Windows security feature that creates a Zone.Identifier alternate data stream on files downloaded from the internet, serving as a forensic artifact to track file origins 0:00.
Key Takeaways:
• The mark of the web stores information including the Zone ID and the exact URL where the file was downloaded from within the Zone.Identifier alternate data stream 2:15
• You can view alternate data streams using the dir /R command in command prompt or PowerShell's Get-Item -Stream * cmdlet 1:37
• This security feature protects users from unknown binaries by potentially blocking files from the internet until they're manually unblocked 3:20
• Registry keys can control whether Zone information is preserved and whether users can see the "unblock" option in file properties 8:40
• The "HideZoneInfoOnProperties" registry setting can prevent users from seeing and removing the security block, adding an additional layer of protection 14:49
Understanding the mark of the web provides valuable forensic capabilities for tracking file origins and managing security risks on Windows systems.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
how can you determine where on the internet a file was downloaded from well there are a lot of different ways but one that I'd like to show you in this video could be pretty useful as a forensic artifact on Windows and that is the mark of the web and you might already be familiar with this not even realizing it but to show you I've downloaded this file here I have putty.exe on my desktop you know putty the client for SSH and telnet often times ran on Windows and if I were to right click and take a look at the properties you can see down at the bottom here the security row says hey this file came from another computer and it might be blocked to help protect this computer so maybe in some instructions that you've read following a guide doing some schoolwork I don't know whatever case maybe y…