Displaying Hidden Files Feature Disabled

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1564.001` Hide Artifacts: Hidden Files and Directories

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Displaying Hidden Files Feature Disabled
id: 5a5152f1-463f-436b-b2f5-8eceb3964b42
status: test
description: |
    Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files.
    This technique is abused by several malware families to hide their files from normal users.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-8---hide-files-through-registry
author: frack113
date: 2022-04-02
modified: 2024-03-26
tags:
    - attack.stealth
    - attack.t1564.001
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith:
            - '\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden'
            - '\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden'
        Details: 'DWORD (0x00000000)'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetObject|endswith:
        - '\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden'
        - '\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden'
    Details: 'DWORD (0x00000000)'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	eq	`DWORD (0x00000000)` corpus 38 (sigma 36, chronicle 2)	`field:"Details" kind:eq value:"DWORD (0x00000000)"`
`TargetObject`	ends_with	`\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden` `\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden`	`field:"TargetObject" kind:ends_with`