Registry Modification to Hidden File Extension

 1title: Registry Modification to Hidden File Extension
 2id: 5df86130-4e95-4a54-90f7-26541b40aec2
 3status: test
 4description: Hides the file extension through modification of the registry
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd
 7    - https://unit42.paloaltonetworks.com/ransomware-families/
 8    - https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A
 9author: frack113
10date: 2022/01/22
11modified: 2023/08/17
12tags:
13    - attack.persistence
14    - attack.t1137
15logsource:
16    category: registry_set
17    product: windows
18detection:
19    selection_HideFileExt:
20        TargetObject|endswith: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt'
21        Details: 'DWORD (0x00000001)'
22    selection_Hidden:
23        TargetObject|endswith: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden'
24        Details: 'DWORD (0x00000002)'
25    condition: 1 of selection_*
26falsepositives:
27    - Administrative scripts
28level: medium

References

• atomic-red-team/atomics/T1112/T1112.md at f339e7da7d05f6057fdfcdd3742bfcf365fee2a9 · redcanaryco/atomic-red-team

  

  Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team

  
  Read More

• Ransomware Families: 2021 Data to Supplement the Unit 42 Ransomware Threat Report

  

  We discuss the propagation of different ransomware families we observed in the wild in early 2021 and the different types of extortion used.

  
  Read More

• https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A

  
  Read More

Related rules

• IE Change Domain Zone
• Outlook Macro Execution Without Warning Setting Enabled
• Outlook Security Settings Updated - Registry
• Outlook Task/Note Reminder Received
• Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting