MOTW Bypass Validation Script for Windows Endpoints

Purpose of the Script

Windows Mark of the Web (MOTW) tags files downloaded from the internet with metadata that triggers security warnings when opened. When MOTW fails, your endpoint protection loses a critical signal about file origin. The CVE-2026-45595 vulnerability shows how attackers can bypass this tagging mechanism over a network, allowing malicious files to execute without warnings.

This PowerShell script checks if MOTW is working correctly on your Windows endpoints. Run it against representative systems to detect bypass conditions before an attacker exploits them. The script verifies three things: whether MOTW tags are applied to downloaded files, whether your security controls respect those tags, and whether network-based delivery methods can bypass the tagging process.

You're not testing for CVE-2026-45595 specifically. You're creating a repeatable validation process that catches MOTW failures regardless of the cause.

Prerequisites

Before running this script, ensure:

• PowerShell 5.1 or later on target Windows systems
• Local administrator rights on test endpoints
• A controlled test environment for safe file downloads
• Write access to a temporary directory for test file creation
• Network access to a web server you control (for network-based tests)
• Access to endpoint detection and response (EDR) or antivirus logs for validation

Don't run this against production endpoints until you've validated the script's behavior in a test environment. The script downloads files and creates executables as part of its testing process.

The Validation Script

# MOTW Validation Script v1.0
# Tests whether Mark of the Web tagging is functioning correctly

param(
    [string]$TestFileURL = "https://yourdomain.com/testfile.exe",
    [string]$TestDirectory = "$env:TEMP\MOTWTest",
    [switch]$NetworkTest = $false,
    [switch]$Verbose = $false
)

function Write-TestLog {
    param([string]$Message, [string]$Level = "INFO")
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $output = "[$timestamp] [$Level] $Message"
    Write-Host $output
    Add-Content -Path "$TestDirectory\motw_validation.log" -Value $output
}

function Test-MOTWTag {
    param([string]$FilePath)
    
    try {
        $stream = Get-Content -Path $FilePath -Stream Zone.Identifier -ErrorAction SilentlyContinue
        if ($stream) {
            Write-TestLog "PASS: MOTW tag detected on $FilePath" "SUCCESS"
            Write-TestLog "Zone data: $stream" "INFO"
            return $true
        } else {
            Write-TestLog "FAIL: No MOTW tag found on $FilePath" "ERROR"
            return $false
        }
    } catch {
        Write-TestLog "ERROR: Could not read MOTW tag: $_" "ERROR"
        return $false
    }
}

function Test-BrowserDownload {
    Write-TestLog "Testing browser-based download..." "INFO"
    
    $testFile = "$TestDirectory\browser_download.txt"
    
    try {
        $webClient = New-Object System.Net.WebClient
        $webClient.DownloadFile($TestFileURL, $testFile)
        
        Start-Sleep -Seconds 2
        return Test-MOTWTag -FilePath $testFile
    } catch {
        Write-TestLog "Browser download test failed: $_" "ERROR"
        return $false
    }
}

function Test-NetworkCopy {
    param([string]$NetworkPath)
    
    Write-TestLog "Testing network-based file copy..." "INFO"
    
    if (-not $NetworkTest) {
        Write-TestLog "Network test skipped (use -NetworkTest flag to enable)" "INFO"
        return $null
    }
    
    $testFile = "$TestDirectory\network_copy.exe"
    
    try {
        Copy-Item -Path $NetworkPath -Destination $testFile -Force
        Start-Sleep -Seconds 2
        return Test-MOTWTag -FilePath $testFile
    } catch {
        Write-TestLog "Network copy test failed: $_" "ERROR"
        return $false
    }
}

function Test-ExecutionWarning {
    param([string]$FilePath)
    
    Write-TestLog "Checking if security warnings appear for tagged file..." "INFO"
    
    Write-TestLog "MANUAL STEP: Attempt to execute $FilePath" "ACTION"
    Write-TestLog "EXPECTED: Windows should display security warning about file origin" "ACTION"
    Write-TestLog "Record whether warning appeared (Y/N): " "ACTION"
}

# Main execution
Write-TestLog "Starting MOTW validation" "INFO"

# Create test directory
if (-not (Test-Path $TestDirectory)) {
    New-Item -ItemType Directory -Path $TestDirectory | Out-Null
}

# Run tests
$results = @{
    BrowserDownload = Test-BrowserDownload
    NetworkCopy = if ($NetworkTest) { Test-NetworkCopy -NetworkPath "\\yourserver\share\testfile.exe" } else { $null }
}

# Summary
Write-TestLog "=== VALIDATION SUMMARY ===" "INFO"
foreach ($test in $results.Keys) {
    $result = $results[$test]
    $status = if ($result -eq $true) { "PASS" } elseif ($result -eq $false) { "FAIL" } else { "SKIPPED" }
    Write-TestLog "$test : $status" "INFO"
}

Write-TestLog "Review log at: $TestDirectory\motw_validation.log" "INFO"

Customizing the Script

Replace $TestFileURL with a URL pointing to a benign test file on your infrastructure. Don't use a real executable. Create a text file, rename it to .exe, and host it on your web server. The file doesn't need to be functional, you're testing the tagging mechanism, not execution.

To test network-based bypass scenarios (relevant to CVE-2026-45595), set $NetworkTest to $true and provide a network share path in the Test-NetworkCopy function. This checks if files copied from network locations receive MOTW tags. The vulnerability allows attackers to bypass MOTW over a network, so this test reveals whether your endpoints are susceptible.

Adjust $TestDirectory if you need to store test artifacts in a specific location. Your EDR may flag the script's file creation activity, whitelist the test directory temporarily or coordinate with your security operations team.

Add additional download methods to the script based on how your users receive files. Do they use SharePoint, OneDrive, or email attachments through Outlook Web Access? Each delivery method should have its own test function: download the file, wait for tagging, check for the Zone.Identifier stream.

Validation Steps

Run the script on a representative sample of endpoints across different network segments. You're looking for patterns, not universal coverage. Test at least:

• One endpoint per Windows version in your environment (Windows 10, Windows 11, Server 2019, Server 2022)
• Endpoints in different security zones (DMZ, internal network, remote VPN users)
• Systems with different EDR agents or antivirus products installed

Check the log file after each run. A passing result shows the Zone.Identifier stream with ZoneId=3 (Internet zone) or ZoneId=4 (Restricted sites zone). If you see consistent failures on specific endpoint types, investigate whether group policy settings, EDR configurations, or Windows updates have disabled MOTW tagging.

The manual execution warning test is crucial. MOTW tags mean nothing if your security controls don't act on them. Double-click the tagged test file. You should see a Windows security warning dialog before the file opens. If the file opens immediately without a warning, your endpoint protection isn't enforcing MOTW policies, even if the tags are present.

For network-based tests, a failure indicates your endpoints may be vulnerable to the same class of bypass that CVE-2026-45595 exploits. Files copied from network shares should receive MOTW tags if the share is outside your local intranet zone. If they don't, attackers can deliver malicious files over SMB without triggering security warnings.

Schedule this validation quarterly, after Windows updates, and whenever you change endpoint security configurations. MOTW isn't a single control, it's a chain of tagging, policy enforcement, and user warnings. Each link needs verification.

Windows Security Warning