Windows process activity enabling Developer Mode or sideloading via SystemSettingsAdminFlows.exe
Alerts on SystemSettingsAdminFlows.exe command lines enabling Developer Mode unlock or application sideloading.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-11
- Updated
- 2026-07-30
What it detects
This rule flags process creation events where SystemSettingsAdminFlows.exe is executed with command-line arguments that turn on developer features, including Developer Mode unlock and application sideloading. Such settings can allow installation of untrusted packages, increasing the risk of stealthy malware deployment. It relies on Windows process creation telemetry, matching the executable name and specific command-line substrings used to enable these features.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-activity-enabling-developer-mode-or-sideloading-via-systemsettin-a383dec4
title: Windows process activity enabling Developer Mode or sideloading via SystemSettingsAdminFlows.exe
id: 40f4d2ff-b34e-40d2-8d36-81b5b6e8dc61
related:
- id: b110ebaf-697f-4da1-afd5-b536fa27a2c1
type: similar
- id: a383dec4-deec-4e6e-913b-ed9249670848
type: derived
status: test
description: This rule flags process creation events where SystemSettingsAdminFlows.exe is executed with command-line arguments that turn on developer features, including Developer Mode unlock and application sideloading. Such settings can allow installation of untrusted packages, increasing the risk of stealthy malware deployment. It relies on Windows process creation telemetry, matching the executable name and specific command-line substrings used to enable these features.
references:
- Internal Research
- https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_systemsettingsadminflows_turn_on_dev_features.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \SystemSettingsAdminFlows.exe
- OriginalFileName: SystemSettingsAdminFlows.EXE
selection_flag:
CommandLine|contains: TurnOnDeveloperFeatures
selection_options:
CommandLine|contains:
- DeveloperUnlock
- EnableSideloading
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1