Displaying Hidden Files Feature Disabled

Title: Displaying Hidden Files Feature Disabled
Status: test
Description:Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-8---hide-files-through-registry
Author: frack113
Date: 2022-04-02
modified:2024-03-26
Tags:

• -'attack.stealth'
• -'attack.t1564.001'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith:
      -'\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden'
      -'\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden'

    Details: 'DWORD (0x00000000)'
  condition:selection
Falsepositives:
  -Unknown
Level: medium