Detection of Registry Modifications to Disable Hidden File Visibility

Adversaries often modify specific registry keys within the Windows Explorer configuration to alter how the operating system handles file visibility. By setting the 'Hidden' and 'ShowSuperHidden' registry values to zero (DWORD 0), attackers can suppress the display of hidden and protected operating system files. This modification effectively hides malicious payloads, dropped tools, and configuration files from a user's view in Windows Explorer, facilitating stealth during post-exploitation activities. This technique is commonly observed in various malware families aiming to evade manual discovery by local users. Security teams should monitor for unauthorized changes to these specific registry locations to detect potential attempts to manipulate file visibility settings as part of an attacker's evasion strategy.

Impact

Successful exploitation of this technique allows attackers to persist and maintain a low profile on compromised systems by obscuring malicious files. This reduces the likelihood of detection by non-technical users and complicates manual incident response efforts by hiding the presence of secondary staging directories or malware binaries.

Recommendation

Deploy detection rules to monitor for unauthorized modifications to registry keys governing hidden file display settings.

• Implement the provided Sigma rule to alert on registry set events targeting 'Hidden' and 'ShowSuperHidden' values.
• Audit endpoints for existing configurations where hidden file visibility has been globally disabled through these registry keys.
• Correlate these registry modifications with other suspicious activities, such as unusual process creation or file system changes, to confirm malicious intent.