Detectionhightest

Potential Signing Bypass Via Windows Developer Features - Registry

Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Thu Jan 12Updated Thu Aug 17b110ebaf-697f-4da1-afd5-b536fa27a2c1windows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|contains:
            - '\Microsoft\Windows\CurrentVersion\AppModelUnlock'
            - '\Policies\Microsoft\Windows\Appx\'
        TargetObject|endswith:
            - '\AllowAllTrustedApps'
            - '\AllowDevelopmentWithoutDevLicense'
        Details: 'DWORD (0x00000001)'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion

Related Rules

SimilarDetectionhigh

Potential Signing Bypass Via Windows Developer Features

Detects when a user enable developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

b110ebaf-697f-4da1-afd5-b536fa27a2c1

Status

test

Level

high

Type

Detection

Created

Thu Jan 12

Modified

Thu Aug 17

Author

Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/registry/registry_set/registry_set_turn_on_dev_features.yml

Raw Tags

attack.defense-evasion

View on GitHub