What Is Mark of the Web? How Windows Tags Downloads

Mark of the Web is the label Windows attaches to files that arrive from the internet, so that Windows, SmartScreen and Office know to treat them with suspicion. It is stored as a small hidden stream on the file itself, not in a central database. Knowing what Mark of the Web is, where it gets added and where it gets lost explains why a bypass such as the exploited Windows Shell flaw CVE-2026-96951 removes several protections at once.

What is Mark of the Web?

Mark of the Web is a zone tag that Windows writes onto a downloaded file to record where it came from. Programs that open the file read the tag and decide whether to warn the user, open it in a restricted mode or block active content.

Microsoft's Office documentation says the tag is added to files from untrusted locations such as the internet or the Restricted sites zone. Browser downloads and email attachments are the common cases.

How does Windows store the mark?

Windows stores it in an NTFS alternate data stream named Zone.Identifier attached to the file. The stream holds a [ZoneTransfer] section with a ZoneId value that maps to one of the Internet Options security zones.

Microsoft lists the values as:

• 0: My Computer
• 1: Local intranet
• 2: Trusted sites
• 3: Internet
• 4: Restricted sites

By default only zones 3 and 4 get a mark. Microsoft's documentation shows a quick way to read it from a command prompt, replacing the placeholder with the file name:

notepad {name of file}:Zone.Identifier

Notepad opens the stream and shows the ZoneId. If the stream does not exist, the file carries no mark.

What does Mark of the Web control?

Several separate features read the same tag, which is why one bypass has a wide effect:

• Office macros. Since version 2203 on Current Channel (Preview) and version 2208 on Semi-Annual Enterprise Channel, Access, Excel, PowerPoint, Visio and Word block VBA macros in files with an Internet or Restricted mark. Users see a Security Risk banner with no Enable content button.
• Protected View. Office opens marked documents read-only until the user chooses to edit.
• SmartScreen and open-file warnings. Windows checks marked executables and shows a prompt before running them.

When the mark is missing or ignored, all three treat the file like something the user created locally. SOCRadar's analysis of the October 2026 Patch Tuesday makes exactly this point about CVE-2026-96951: SmartScreen and Protected View warnings do not appear. Our news coverage of the Windows Shell CVE-2026-96951 bypass covers the affected builds and KB numbers.

Where does the mark get lost?

The mark lives on the file, so anything that copies the bytes without the stream drops it. Microsoft documents several cases:

• FAT32 and other non-NTFS volumes. Mark of the Web only applies on NTFS. A file copied to a FAT32 USB stick loses its stream.
• The Unblock checkbox and Unblock-File. Both remove the ZoneId. Users can do this themselves from the file's Properties dialog.
• Sync clients. Files downloaded by the OneDrive sync client, opened with Open in Desktop App, or stored in OneDrive-synced known folders such as Desktop and Documents have no mark.
• Trusted Locations and Trusted sites. Files saved to an Office Trusted Location skip the macro check. Adding a share to Trusted sites or Local intranet does the same for everything stored there.

The last two are configuration choices. Each one is a hole you created on purpose, so it should be documented and kept small.

Why do attackers target Mark of the Web?

Because removing the mark turns a blocked, warned-about file into one that opens silently. The attacker still needs a user to open the file, but every warning that would have stopped that user is gone.

Phishing crews have spent years looking for file formats and containers that arrive without a mark or lose it on extraction. A flaw in the Windows Shell itself is more valuable than a format trick, because the shell handles every double-click. That is why three exploited Windows Shell bypasses in one year is a pattern worth tracking, and why we argue in why security feature bypass bugs deserve emergency patching that the Important rating undersells them.

How should admins use Mark of the Web?

Treat it as one layer, enforced by policy rather than left to defaults.

1. Enable the Office macro policy. Microsoft recommends the "Block macros from running in Office files from the Internet" policy for each Office app as part of its Microsoft 365 Apps security baseline. It lives under User Configuration in the Office administrative templates.
2. Audit your zone assignments. The "Site to Zone Assignment List" policy controls which sites and shares count as Trusted sites or Local intranet. Every entry is a place files arrive without a mark.
3. Keep Trusted Locations few and write-restricted. Microsoft's own guidance is to use them sparingly and control who can save files there.
4. Patch the shell promptly. Policy cannot help if the component that reads the tag ignores it. Roll out fixes like the October 2026 update with patch deployment rings for a Windows zero-day, starting with the users who open the most outside files.

Common mistakes with Mark of the Web

• Assuming it is a security boundary. It is a label that other checks read, and a label can be lost or ignored. Defenders should treat it as a signal, backed by application control and EDR.
• Teaching users to unblock files. A help desk script that says "right-click, Properties, Unblock" trains users to remove the one warning that matters.
• Adding whole SharePoint tenants to Trusted sites to stop complaints. Anyone who can upload to that tenant can then deliver macro-enabled files with no prompt.