Potential Mark-of-the-Web Bypass Attempt via Registry Modification

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects a registry modification that bypasses the Mark-of-the-Web (MOTW) security zone check, suppressing the warning dialog normally shown when executing files downloaded from the internet. The setting persists across the user session and affects all shell-launched processes, enabling malware to silently execute internet-origin payloads without user confirmation.

2026-11-03 00:00:00

None

7abcbb81-5220-40a3-8048-57d4927c022f

attack.defense-impairment attack.t1553.005

Nextron Sigma feed only (private)