Zone.Identifier is an NTFS alternate data stream that Windows uses to store origin metadata for downloaded files. This information is part of the Mark-of-the-Web trust signal and can indicate that a file came from the internet or another untrusted location. Applications such as Microsoft Office and some browser-integrated features use it to decide whether to show warnings, block active content, or open a file in a protected mode.
In cyber security, Zone.Identifier matters because it helps the operating system and endpoint tools apply extra scrutiny to risky content. Attackers sometimes remove this stream to suppress prompts and make a file look locally created, which can reduce user caution and weaken some defenses. Defenders look for files that lose this metadata unexpectedly, especially after download, extraction, or staging activity, because stripping Zone.Identifier is often a sign of delivery, evasion, or tampering rather than normal use.