Windows Explorer File Visibility Registry Modification

Duo Tech@duotech

•updated Jun 4, 2026•0•0•7

Detects the modification of Windows Explorer registry keys (Hidden, ShowSuperHidden, HideFileExt) designed to conceal files and file extensions. This defense evasion technique is notably used by the Gamaredon group's GammaWorm to hide dropped payloads, replaced LNK files, and malicious directories.