Mostly as a reminder for myself, here is how to set the Alternate Data Stream to mark a file as originating from the Internet.
notepad install.exe:Zone.Identifier
Text:
[ZoneTransfer]
ZoneId=3
Zone IDs: here.
Thursday 17 November 2016
6 Comments »
RSS feed for comments on this post. TrackBack URI
Didier Stevens 
[…] Quickpost: Zone.Identifier […]
Pingback by Overview of Content Published In November | Didier Stevens — Tuesday 6 December 2016 @ 0:00
[…] After all, the PDF document was e-mailed to the victims, and Outlook will mark the PDF with a mark-of-web when it is saved to […]
Pingback by Malicious Documents: The Matryoshka Edition | Didier Stevens — Thursday 20 April 2017 @ 0:02
[…] Mostly as a reminder for myself, here are the Internet Zone IDs (taken from HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones on a Windows 8.1 machine, there is also a HKLM entry) as used in the Zone.Identifier ADS: […]
Pingback by Quickpost: Internet Zone IDs | Didier Stevens — Tuesday 9 May 2017 @ 0:00
[…] .iso file downloaded from the Internet (thus with a Zone.Identifier ADS) opened in Windows 10 will not propagate this “mark-of-the-web” to the contained […]
Pingback by .ISO Files With Zone.Identifier | Didier Stevens — Tuesday 18 July 2017 @ 22:20
[…] stopped running. That’s when it dawned on me: when I downloaded psexec, I left the mark-of-web on the file. SmartScreen did now allow psexec to run because it was downloaded from the Internet. […]
Pingback by Abusing A Writable Windows Service | Didier Stevens — Tuesday 5 September 2017 @ 0:01
[…] On Windows, files downloaded from the Internet (with Internet Explorer or Edge, for example) have metadata in an Alternate Data Stream to indicate their origin. This is the Zone.Identifier ADS. […]
Pingback by zoneidentifier.exe | Didier Stevens — Wednesday 25 December 2019 @ 13:53