Unit 1: How Windows is organised · Lesson 4 of 5 · 16 min
Where a download came from
Read the hidden Zone.Identifier stream to prove where a file was downloaded from.
mission
- You are
- You are the IT analyst on call at Brightwater Logistics.
- Situation
- Mara insists the invoice came from a supplier she trusts. Windows tags every file a browser downloads with a hidden note saying where it came from.
- Goal
- Read that note and confirm the real source of the invoice.
- Hand in
- The zone and the web address the invoice was downloaded from.
A tag tied to every download
Show alternate data streams
NTFS files can carry extra named streams. dir /r lists them next to the file.
dir /r Downloads
you should see Open ws-014/downloads/dir-r.txt in the lab. Streams appear as name:Zone.Identifier:$DATA.
Read the stream
The stream is plain text. ZoneId 3 means internet, and HostUrl is where the bytes came from.
Get-Content C:\Users\m.osei\Downloads\remittance-advice.pdf -Stream Zone.Identifier
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://outlook.office.com/
HostUrl=https://attachments.office.net/remittance-advice.pdf
defender tip Zones: 0 this computer, 1 local intranet, 2 trusted sites, 3 internet, 4 restricted sites.
Why the tag matters
| Command | What it does |
|---|---|
SmartScreen | Warns before running tagged programs |
Office protected view | Opens tagged documents read only, macros off |
Missing tag | Copied from USB, unzipped by some tools, or stripped on purpose |
Compare the invoice
Now read the invoice's stream in the lab and compare the domain with Brightwater's real billing supplier.
cat ws-014/downloads/Invoice_8841.pdf.exe.Zone.Identifier
you should see A domain that only looks like a Brightwater one. Report it so mail filters and the proxy can block it.
Find every file with an internet mark
Search for all Zone.Identifier exports at once instead of reading them one by one.
find / -name '*.Zone.Identifier'
you should see Two files carry the mark. The third file in Downloads came some other way, or had its mark removed.
defender tip Office blocks macros in files with the internet mark, and SmartScreen checks marked programs. Unzipping with some tools drops the mark, which is why lures ship archives.
Two downloads, two stories
ZoneId=3 ReferrerUrl=https://mail.brightwater-billing.example/view/8841 HostUrl=https://files.brightwater-billing.example/d/Invoice_8841.pdf.exe
A look-alike domain and a program pretending to be a PDF.
ZoneId=3 ReferrerUrl=https://outlook.office.com/ HostUrl=https://attachments.office.net/remittance-advice.pdf
An attachment opened from the real mail service.
What a defender takes away
- 1Downloads carry a Zone.Identifier stream with the zone and source URL.
- 2Read it with
dir /randGet-Content -Stream Zone.Identifier. - 3A missing tag on a file that should have one is itself worth asking about.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.