Windows Registry Change Disabling Hidden and System File Display

title: Windows Registry Change Disabling Hidden and System File Display
id: d5af5d2c-9bc4-4e0e-8196-9507366a94d0
status: test
description: This rule flags registry value updates that set the Explorer Advanced settings for Hidden and ShowSuperHidden to DWORD 0x00000000. Disabling these display options can help attackers reduce visibility of files and activity on the system. It relies on Windows registry set telemetry capturing the TargetObject path and the written DWORD value.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-8---hide-files-through-registry
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_hide_file.yml
author: frack113, Huntrule Team
date: 2022-04-02
modified: 2024-03-26
tags:
  - attack.stealth
  - attack.t1564.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith:
      - \Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
      - \Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 5a5152f1-463f-436b-b2f5-8eceb3964b42
    type: derived