Hey everyone, is it possible to query the Mark-of-the-web attribute of a file in Windows using Osquery? In powershell it looks like:

Get-Content <target_file> -Stream Zone.Identifier

I don’t think so. There’s an old request for this https://github.com/osquery/osquery/issues/5250 But I don’t know there’s an implementation.

thanks for confirming seph!