Potential Mark-of-the-Web Bypass via Environment Variable

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects a suspicious environment variable in a process environment during THOR's environment variable analysis that indicates an attempt to suppress the MOTW security zone warning dialog. When exploited, this allows internet-origin payloads to execute silently without triggering the user confirmation prompt.

2026-11-03 00:00:00

None

c4f72a1b-9e38-4d5c-b016-3a7f8e2d94c1

attack.defense-impairment attack.t1553.005

Nextron Sigma feed only (private)