Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

Read More

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

Read More

Detects usage of attrib.exe to hide files from users.

Read More

Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging

Read More

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

Read More

Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs

Read More

Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files

Read More