Suspicious Disabling of Displaying Hidden Files Feature (via registry_set)

title: Suspicious Disabling of Displaying Hidden Files Feature (via registry_set)
id: 19c8d111-4cc0-5d69-9b44-35931d4e3e98
status: stable
description: This rule detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values to disable showing of hidden files and system files. This method is misused by several malware families to hide their files from normal users.
references:
    - https://attack.mitre.org/techniques/T1564/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-8---hide-files-through-registry
author: Huntrule Team
date: 2026-07-20
tags:
    - attack.stealth
    - attack.t1564.001
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith:
            - '\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden'
            - '\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden'
        Details: 'DWORD (0x00000000)'
    condition: selection
falsepositives:
    - Unknown
level: medium