Mark of the Web - Manually Add MOTW to a file (Alternate Data Streams)

Save data to an Alternate Data Stream

• Manually add the Mark of the Web to a file for testing:

set-content "<FILE NAME>:Zone.Identifier" "[ZoneTransfer]`r`nZoneId=3`r`n"

PowerShell - List a file’s data streams:

get-item "<FILE NAME>" -Stream * | select Stream

Alternate: List data streams from cmd.exe:

cmd /c dir /r <FILENAME>

Read data from a Data Stream:

get-content ".\<FILE NAME>:Zone.Identifier"

Delete an Alternate Data Stream:

remove-item -Verbose ".\<FILE NAME>:Zone.Identifier"