Displaying Hidden Files Feature Disabled

testmedium
log source: windows · registry_setauthor frack113date 2022-04-02
01

description

What this is, in brief.

Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

02

tags

attack.stealthattack.t1564.001
03

rule source (YAML)

title: Displaying Hidden Files Feature Disabled
id: 5a5152f1-463f-436b-b2f5-8eceb3964b42
status: test
description: |
    Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files.
    This technique is abused by several malware families to hide their files from normal users.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-8---hide-files-through-registry
author: frack113
date: 2022-04-02
modified: 2024-03-26
tags:
    - attack.stealth
    - attack.t1564.001
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith:
            - '\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden'
            - '\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden'
        Details: 'DWORD (0x00000000)'
    condition: selection
falsepositives:
    - Unknown
level: medium
simulation:
    - type: atomic-red-team
      name: Hide Files Through Registry
      technique: T1564.001
      atomic_guid: f650456b-bd49-4bc1-ae9d-271b5b9581e7
04

detects techniques (1)

ATT&CK techniques this enables or maps to.

05

references

External citations — patches, advisories, analysis.