Displaying Hidden Files Feature Disabled

Severity: medium
Author: frack113
Source: upstream

Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1564.001` Hide Artifacts: Hidden Files and Directories

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)

Stages and Predicates

Stage 1: `selection`

or:
TargetObject|endswith: '\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden'
TargetObject|endswith: '\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden'
Details: 'DWORD (0x00000000)'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.