This was tested on a few Twitter threads, the confirmation being yes, .zip files and even .iso files will retain the mark of the web confirming they were downlo

This was tested on a few Twitter threads, the confirmation being yes, .zip files and even .iso files will retain the mark of the web confirming they were downloaded. The special case is where 7-zip is used, which doesn't respect that marker. How many businesses actually deploy that globally? Well this same thread on Reddit resulted on several "oh, but I deployed 7-zip across the enterprise" answers. And yes, every single org I've walked into to talk about security, my very first discussion has been about macros because they've been globally enabled in every business I've walked into.