Mark-of-the-web and pinning installers to sites
Summary
The article explains Mark-of-the-Web (MoTW), how Windows uses alternate data streams to persist provenance on downloaded files, and demonstrates introspection on a MoTW-protected binary. It discusses limitations, potential defense benefits, and real-world abuse cases like ScreenConnect campaigns, emphasizing that MoTW is not authenticated and can be tampered, but can still influence attacker-resilience when used appropriately.