HIDDENDRIVER Rootkit Registry Configuration

nomit vyas@xoxo

•updated Jun 23, 2026•0•0•1

Detects the creation or modification of registry values used by the HIDDENDRIVER rootkit to configure its hiding and protection capabilities. This rootkit, a modified version of the open-source "Hidden" project, uses these registry entries to define which files, processes, and registry keys to conceal. This activity is associated with the REF3927 threat actor and the TOLLBOOTH malware campaign.