huntrule

Windows Registry Set to Hide File Extensions via Explorer Advanced Keys

Flags registry changes under Explorer Advanced that hide file extensions by setting specific DWORD values.

FreeReviewedSigma · Medium · v1
Product
windows
Category
registry_set
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-01-22
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows registry modifications that enable Explorer settings to hide file extensions by setting DWORD values under the Advanced configuration keys. Hiding file extensions can help attackers conceal malicious or disguised files from casual user inspection. Telemetry relies on registry set events that include the modified TargetObject path and the DWORD data values.

Reporting behind it

Related detections9 linkedT1137 — drag to rearrange
Suspicious Office Application Spawning Mshta With Remote HTA
Malicious NotDoor Outlook VBA Persistence via VbaProject.OTM Deployment (via process_creation)
Malicious NotDoor Outlook Macro Auto-Execution Enablement via Registry (via registry_set)
Office Persistence via WLL Add-in Dropped to Word STARTUP Folder
Windows Registry Changes for Outlook Task/Note Reminder Trigger
Windows: Suspicious Outlook VbaProject.OTM Macro File Created
Windows Office Startup Folder File Drop for Persistence via Office Documents
Windows Registry: IE ZoneMap Domain Zone Change via ZoneMap\Domains
Windows Registry Changes to Outlook Security Settings
Windows Registry Set to Hide File Extensions via Explorer Advanced Keys
Pivot detection · T1137 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.