ATT&CK technique
View on MITRE ATT&CK →
T1553.005
Mark-of-the-Web Bypass
Defense Impairment
12 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Mark-of-the-Web Removal by an Unusual Process | production | 2026-09-25 |
| splunk | Windows Mark Of The Web Bypass | production | 2026-07-20 |
| splunk | Windows Advanced Installer MSIX with AI_STUBS Execution | production | 2026-05-13 |
| splunk | Windows AppX Deployment Full Trust Package Installation | production | 2026-05-13 |
| splunk | Windows AppX Deployment Unsigned Package Installation | production | 2026-05-13 |
| splunk | Windows Developer-Signed MSIX Package Installation | production | 2026-05-13 |
| sigma | Windows AppX Deployment Full Trust Package Installation | experimental | 2025-11-03 |
| sigma | Windows AppX Deployment Unsigned Package Installation | experimental | 2025-11-03 |
| sigma | Windows MSIX Package Support Framework AI_STUBS Execution | experimental | 2025-11-03 |
| sigma | Suspicious Invoke-Item From Mount-DiskImage | test | 2022-02-01 |
| sigma | Suspicious Mount-DiskImage | test | 2022-02-01 |
| sigma | Suspicious Unblock-File | test | 2022-02-01 |