Registry Modification to Hide File Extensions or Files

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

This rule detects modifications to the Windows Registry that are used to hide file extensions or make files hidden. Specifically, it looks for changes to the 'HideFileExt' and 'Hidden' DWORD values within the 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' registry key. Setting 'HideFileExt' to '0x00000001' hides known file extensions, and setting 'Hidden' to '0x00000002' shows hidden files, which could be used by an attacker to manipulate visibility of malicious files.