Windows Registry Set to Hide File Extensions via Explorer Advanced Keys

title: Windows Registry Set to Hide File Extensions via Explorer Advanced Keys
id: 25fac448-0a45-433a-bdda-514ca55f4256
status: test
description: This rule identifies Windows registry modifications that enable Explorer settings to hide file extensions by setting DWORD values under the Advanced configuration keys. Hiding file extensions can help attackers conceal malicious or disguised files from casual user inspection. Telemetry relies on registry set events that include the modified TargetObject path and the DWORD data values.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd
  - https://unit42.paloaltonetworks.com/ransomware-families/
  - https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_hidden_extention.yml
author: frack113, Huntrule Team
date: 2022-01-22
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.t1137
logsource:
  category: registry_set
  product: windows
detection:
  selection_HideFileExt:
    TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
    Details: DWORD (0x00000001)
  selection_Hidden:
    TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
    Details: DWORD (0x00000002)
  condition: 1 of selection_*
falsepositives:
  - Administrative scripts
level: medium
license: DRL-1.1
related:
  - id: 5df86130-4e95-4a54-90f7-26541b40aec2
    type: derived