This rule detects an unusual process deleting the Zone.Identifier alternate data stream (ADS) on Windows executables or MSI packages. Attackers sometimes remove Zone.Identifier to bypass Mark-of-the-Web (MOTW) protections and enable execution without the security prompts or Slimming of SmartScreen checks. The rule triggers on file deletion events for Zone.Identifier ADS on .exe or .msi artifacts and excludes legitimate Windows Explorer unblocking scenarios where Explorer.exe is trusted and signed by Microsoft Windows. By focusing on MOTW bypass activity rather than file creation or download itself, it targets defense evasion attempts that seek to disable MOTW safeguards after a file is already present on disk. The detection relies on host OS windows, a deletion event, and file paths matching *.exe:Zone.Identifier, *.exe:Zone.Identifier:$DATA, *.msi:Zone.Identifier, or *.msi:Zone.Identifier:$DATA. It further refines signals by excluding the well-known legitimate MOTW unblock path (Explorer with a trusted Microsoft Windows code signature). This rule aligns with MITRE ATT&CK technique T1553.005 (Mark-of-the-Web Bypass) under Defense Evasion, focusing on subversion of trust controls to enable stealthy execution. The rule is designed for Elastic Defend telemetry and uses File and Process data sources to correlate the artifact (file.path) with the deleting process (process.executable, process.name, process.code_signature fields). It provides guidance for triage, investigation, and remediation, emphasizing corroborating context such as the attacker’s process lineage, user, host, and any follow-on activity. False positives may arise from legitimate workflows that remove MOTW during file handling or deployment tasks, which should be distinguished via provenance and independent records.