Bypass Record
Indicator Removal × Microsoft Windows SmartScreen
A publicly-reported instance of Indicator Removal bypassing Microsoft Windows SmartScreen, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
When an archive is downloaded from the internet, Windows adds an NTFS alternate data stream (Zone.Identifier) marking it as from the internet. 7-Zip, by default, does not copy this MotW to extracted files, so they appear as locally created and bypass SmartScreen reputation checks and warnings.
Detection & mitigation
Monitor for files lacking Zone.Identifier ADS when originating from archive extraction, especially in user-writable directories. Enforce SmartScreen via GPO and consider using endpoint detection that inspects file origin regardless of MotW.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.