NanoCore: Mark-of-the-Web Bypass — Detection

NanoCore strips the Zone.Identifier alternate data stream from its own file so Windows stops treating it as downloaded. It does this with a single DeleteFile call against the stream path — no shell, no LOLBin, which is why command-line telemetry alone misses it.

MITRE ATT&CK: T1553.005

Technique write-up: NanoCore_MOTWBypass

Detection Indicators

The stream name in the delete path is the whole signal. A normal file delete never carries a : suffix.

Log Sources

• Microsoft Defender XDR (DeviceFileEvents)
• Sysmon EID 11 (file create), EID 23/26 (file delete)
• Sysmon EID 23 / 26 carry the stream in TargetFilename

Detection Engineering with Defender XDR

Deletion of a Zone.Identifier stream, and the file that lost it.

DeviceFileEvents
| where ActionType in ("FileDeleted", "FileModified")
| where FileName has "Zone.Identifier" or FolderPath has ":Zone.Identifier"
| project Timestamp, DeviceName, AccountName, ActionType, FileName, FolderPath,
          InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine
| order by Timestamp desc

Detection Engineering with Sysmon

Sysmon reports the full stream path in the delete events.

WindowsEvent //(sysmon)
| where EventID in (23, 26)
| extend TargetFilename = tostring(EventData.TargetFilename)
| where TargetFilename endswith ":Zone.Identifier"
| project TimeGenerated, Computer, EventID, Image = tostring(EventData.Image), TargetFilename

Detection Engineering with SIGMA

Full rule: sigma_nanocore_motw_bypass.yml

detection:
    selection:
        TargetFilename|endswith: ':Zone.Identifier'
    filter_known:
        Image|endswith:
            - '\explorer.exe'
            - '\OUTLOOK.EXE'
    condition: selection and not filter_known

Notes and tuning

explorer.exe and Office legitimately clear the stream when a user ticks Unblock in a file’s properties, so those are filtered. Everything else deleting a Zone.Identifier stream is worth a look, and a process clearing the stream on its own image path is the sample’s exact behaviour.

The YARA rule catches the static side: an assembly that imports DeleteFile and carries the :Zone.Identifier string.

Disclaimer

For educational purposes only!!!