Windows Registry Set to Hide File Extensions via Explorer Advanced Keys
Flags registry changes under Explorer Advanced that hide file extensions by setting specific DWORD values.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-22
- Updated
- 2026-07-30
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows registry modifications that enable Explorer settings to hide file extensions by setting DWORD values under the Advanced configuration keys. Hiding file extensions can help attackers conceal malicious or disguised files from casual user inspection. Telemetry relies on registry set events that include the modified TargetObject path and the DWORD data values.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/ransomware-families/
- microsoft.comhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_hidden_extention.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Set to Hide File Extensions via Explorer Advanced Keys
id: 25fac448-0a45-433a-bdda-514ca55f4256
status: test
description: This rule identifies Windows registry modifications that enable Explorer settings to hide file extensions by setting DWORD values under the Advanced configuration keys. Hiding file extensions can help attackers conceal malicious or disguised files from casual user inspection. Telemetry relies on registry set events that include the modified TargetObject path and the DWORD data values.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd
- https://unit42.paloaltonetworks.com/ransomware-families/
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_hidden_extention.yml
author: frack113, Huntrule Team
date: 2022-01-22
modified: 2023-08-17
tags:
- attack.persistence
- attack.t1137
logsource:
category: registry_set
product: windows
detection:
selection_HideFileExt:
TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
Details: DWORD (0x00000001)
selection_Hidden:
TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
Details: DWORD (0x00000002)
condition: 1 of selection_*
falsepositives:
- Administrative scripts
level: medium
license: DRL-1.1
related:
- id: 5df86130-4e95-4a54-90f7-26541b40aec2
type: derived