Attempt to Hide Files via Registry Modification

[rule]
description = """
This rule detects the modification of registry settings that control how files are visualized to the user via Explorer.
Some malwares will modify those entries to hide malware related files.
"""
id = "4f7b1362-1299-4ce7-8e02-03b74dad4eb1"
license = "Elastic License v2"
name = "Attempt to Hide Files via Registry Modification"
os_list = ["windows"]
version = "1.0.6"

query = '''
registry where event.action == "modification" and process.executable != null and
 registry.key like "S-*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" and
 (
  (registry.value == "HideFileExt" and registry.data.strings == "1") or
  (registry.value == "Hidden" and registry.data.strings == "2") or
  (registry.value == "ShowSuperHidden" and registry.data.strings == "0")
  ) and
  not process.executable :
                ("C:\\Windows\\system32\\svchost.exe",
                 "C:\\Windows\\explorer.exe",
                 "C:\\Windows\\regedit.exe",
                 "C:\\Windows\\System32\\runonce.exe",
                 "C:\\Windows\\System32\\ShellAppRuntime.exe",
                 "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
                 "C:\\Windows\\System32\\SystemPropertiesPerformance.exe",
                 "C:\\Windows\\System32\\SystemPropertiesAdvanced.exe",
                 "C:\\Windows\\System32\\SystemPropertiesComputerName.exe",
                 "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
                 "C:\\Program Files\\KEYENCE\\IM Editor2\\IMController.exe",
                 "C:\\Program Files\\Streamline3\\1.7.1.2\\pxsvc.exe", 
                 "C:\\Windows\\System32\\reg.exe", 
                 "C:\\Windows\\System32\\regsvr32.exe",
                 "C:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
                 "C:\\ADP SmartCompliance PowerTool\\Compliance.exe",
                 "D:\\USMT\\X64\\loadstate.exe",
                 "C:\\Program Files\\*.exe", 
                 "C:\\Program Files (x86)\\*.exe") and
not (process.code_signature.subject_name : ("Cyberdigm. Corp.", "CYBERDIGM CO., LTD.", "Electronic Arts, Inc.") and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"

[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[[threat.technique.subtechnique]]
id = "T1564.001"
name = "Hidden Files and Directories"
reference = "https://attack.mitre.org/techniques/T1564/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"