Windows process activity enabling Developer Mode or sideloading via SystemSettingsAdminFlows.exe

title: Windows process activity enabling Developer Mode or sideloading via SystemSettingsAdminFlows.exe
id: 40f4d2ff-b34e-40d2-8d36-81b5b6e8dc61
related:
  - id: b110ebaf-697f-4da1-afd5-b536fa27a2c1
    type: similar
  - id: a383dec4-deec-4e6e-913b-ed9249670848
    type: derived
status: test
description: This rule flags process creation events where SystemSettingsAdminFlows.exe is executed with command-line arguments that turn on developer features, including Developer Mode unlock and application sideloading. Such settings can allow installation of untrusted packages, increasing the risk of stealthy malware deployment. It relies on Windows process creation telemetry, matching the executable name and specific command-line substrings used to enable these features.
references:
  - Internal Research
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_systemsettingsadminflows_turn_on_dev_features.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \SystemSettingsAdminFlows.exe
    - OriginalFileName: SystemSettingsAdminFlows.EXE
  selection_flag:
    CommandLine|contains: TurnOnDeveloperFeatures
  selection_options:
    CommandLine|contains:
      - DeveloperUnlock
      - EnableSideloading
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1