Hiding of an Installed Application from Application Wizard

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the SystemComponent DWORD registry value being set to 1 under an application's Uninstall key, which removes the application from "Programs and Features" and "Add or Remove Programs" visibility. Threat actors use this technique to hide installed applications, from normal administrative review, as part of persistence or defense evasion strategies.

2026-06-04 00:00:00

None

53e0a5b6-c267-449c-8084-f24baedf26f2

attack.stealth attack.defense-impairment attack.t1112 attack.persistence attack.t1564

Nextron Sigma feed only (private)