huntrule

Windows Registry Change Disabling Hidden and System File Display

Detects registry writes that disable Windows Explorer showing hidden/system files by setting Hidden and ShowSuperHidden to 0x0.

FreeReviewedSigma · Medium · v1
Product
windows
Category
registry_set
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-04-02
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags registry value updates that set the Explorer Advanced settings for Hidden and ShowSuperHidden to DWORD 0x00000000. Disabling these display options can help attackers reduce visibility of files and activity on the system. It relies on Windows registry set telemetry capturing the TargetObject path and the written DWORD value.

Reporting behind it

Related detections9 linkedT1564.001 — drag to rearrange
Suspicious Executable Written to User Documents Subfolder (via file_event)
Suspicious Sobolan Staging Directory Creation in var tmp (via file_event)
FireWood Backdoor Persistence Files in Hidden kde-root Directory (via file_event)
Suspicious Attrib Hiding of Stealer Artifacts (via process_creation)
Suspicious perfctl Hidden IPC Directory Creation in tmp (via file_event)
Suspicious Executable Running From Fake Chrome User Profile Directory
Malicious Cryptominer Staging Files Dropped in tmp Directory
Suspicious Batch Script Unhiding Files via Attrib From Temp
Suspicious Hidden Directory configrc for Bandwidth SDK Abuse
Windows Registry Change Disabling Hidden and System File Display
Pivot detection · T1564.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.