How Windows Secretly Tags Every Downloaded File to Trigger Security Sandboxes

On September 10, 2026, technology outlet MakeUseOf published a technical breakdown by researcher Oluwademilade Afolabi detailing a silent operation that occurs every time a user saves a file from the internet. When a 15-megabyte PDF or a software installer lands in a Windows Downloads folder, the operating system does not just save the document. It attaches a hidden metadata receipt, completely invisible to standard File Explorer views, that records exactly where the data came from.[1]

This hidden receipt is officially known as the Mark of the Web (MotW). It relies on a feature of the NT File System (NTFS) called Alternate Data Streams. While the primary data stream holds the actual contents of the image or document, Windows appends a secondary, concealed stream named Zone.Identifier to the same file.[3]

This secondary stream acts as a permanent security context for the file. According to documentation from the MITRE ATT&CK framework, which tracks this mechanism under sub-technique T1553.005, the operating system uses this metadata to determine how aggressively to restrict the file when a user attempts to open it.[2]

Inside the Zone.Identifier stream, Windows assigns a specific ZoneId integer. A value of 0 indicates a file created on the local machine, 1 represents the Local Intranet, 2 marks Trusted Sites, 3 designates the general Internet, and 4 flags Restricted Sites.

The vast majority of web downloads receive a ZoneId=3 assignment. When a user downloads a file via Google Chrome, Mozilla Firefox, or Microsoft Edge, the browser writes this integer into the Alternate Data Stream. Modern browsers frequently go a step further, embedding the exact HostUrl and ReferrerUrl into the stream to create a forensic record of the download's origin.[3]

Because this data lives in an Alternate Data Stream, it does not alter the primary file hash, nor does it increase the file size reported by the operating system. A user can only see the stream by opening the Windows Command Prompt and executing a dir /r command, which lists the hidden $DATA attachments beneath the standard file names.[1]

The utility of this hidden tag becomes apparent the moment a user double-clicks the file. If the downloaded item is an executable program carrying a ZoneId=3 tag, Windows Defender SmartScreen intercepts the launch sequence. The security software checks the file's cryptographic signature against a Microsoft allowlist before permitting it to run.[3]

The restrictions are even stricter for productivity documents. Starting with Microsoft Office 10, any Word, Excel, or PowerPoint file carrying the Mark of the Web automatically opens in Protected View. This sandboxed, read-only mode prevents the document from interacting with the broader operating system.[2]

In modern Microsoft 365 environments, the presence of the ZoneId=3 tag triggers an automatic block on all Visual Basic for Applications (VBA) macros. As cybersecurity firm Procirrus notes, this mechanism "closes a critical vector for preview-launched malware," preventing malicious scripts from executing the moment a user clicks a file in an email client.

However, the system has a structural limitation: Alternate Data Streams are exclusive to the NTFS file system. If a user copies a tagged file to a USB flash drive formatted with the older FAT32 standard, or moves it to a Linux machine running an Ext4 partition, the secondary stream is instantly stripped away.[3]

When that same file is subsequently copied back to an NTFS Windows drive, it arrives without its Zone.Identifier. The operating system now views the file as a trusted, locally generated document, and all SmartScreen and Protected View restrictions are bypassed.[3]

Threat actors actively exploit this file system limitation. Security researchers frequently observe malware distributed inside container formats—such as specific archive types or disk image files—that do not support Alternate Data Streams. When the user extracts the contents, the resulting files land on the hard drive without the Mark of the Web.[2]

Users can manually remove the tag from a legitimate file by right-clicking it, opening the Properties dialog, and checking the "Unblock" box at the bottom of the General tab. This action deletes the Zone.Identifier stream entirely.[1]

Security professionals advise against treating this checkbox as a routine dismissal of an annoying prompt. As Afolabi writes for MakeUseOf, "Removing the tag removes security context, not whatever risk may exist inside the file." Once the tag is gone, the operating system assumes the user has personally vouched for every line of code inside.[1]