Mark of the Web - Wikipedia
The Mark of the Web (MoTW) is an identifier used by Microsoft Windows to mark files downloaded from the Internet as potentially unsafe. It is implemented as an NTFS Zone.Identifier alternate data stream (ADS) containing an identifier element which indicates (with the "Mark") that a file saved on a computer could contain harmful or malicious content because it was downloaded from an external source ("the Web").[ 1] [ 2]
The Mark of the Web can also be added as an HTML comment inserted by a web browser when downloading an HTML document from the Internet, noting the URL the document was saved from.[ 3]
Because it is a feature of NTFS, the Mark of the Web only affects files opened on computers running the Microsoft Windows operating system.[ 4] Windows warns a user running a Web-marked executable file that it had been downloaded from the Internet and could be harmful; the user can opt either to continue or cancel execution.[ 2] Unless overridden by user action the mark prevents macros from running in Microsoft Office files.[ 5] [ 4] Visual Studio projects created with Web-marked files cannot be built or executed.[ 6]
Some archiving software propagates the MoTW from the archive itself to files extracted from it, preventing its security protection being bypassed by malware distributed within an archive.[ 7] [ 8]
