huntrule

Windows Registry Change Disabling Hidden and System File Display

Detects registry writes that disable Windows Explorer showing hidden/system files by setting Hidden and ShowSuperHidden to 0x0.

FreeReviewedSigma · Medium · v1
Product
windows
Category
registry_set
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-04-02
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags registry value updates that set the Explorer Advanced settings for Hidden and ShowSuperHidden to DWORD 0x00000000. Disabling these display options can help attackers reduce visibility of files and activity on the system. It relies on Windows registry set telemetry capturing the TargetObject path and the written DWORD value.

Reporting behind it

Related detections9 linkedT1564.001 — drag to rearrange
Suspicious File Hiding via attrib Hidden and System Attributes (via process_creation)
Suspicious File Hidden via attrib in Public Documents (via process_creation)
Suspicious Execution from Reserved Device Name Directory by Miner Campaign
Suspicious File Hiding via Attrib System and Hidden Attributes
Suspicious attrib Hidden and System Attribute Assignment
Suspicious File Hiding via attrib Plus H in Java RAT Persistence Setup
Suspicious Execution of Hidden Binary from Private Tmp via Process Creation
Suspicious Executable Written to User Documents Subfolder (via file_event)
Suspicious Sobolan Staging Directory Creation in var tmp (via file_event)
Windows Registry Change Disabling Hidden and System File Display
Pivot detection · T1564.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.