Displaying Hidden Files Feature Disabled via Registry
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values to disable the showing of hidden files and system files. This technique is often abused by malware to hide its files from users.
Sigma
