Windows Registry change enabling developer features for sideloading and untrusted app installs

title: Windows Registry change enabling developer features for sideloading and untrusted app installs
id: a568cb9d-83e1-4a0f-b012-60d8ef143a68
related:
  - id: a383dec4-deec-4e6e-913b-ed9249670848
    type: similar
  - id: b110ebaf-697f-4da1-afd5-b536fa27a2c1
    type: derived
status: test
description: This rule flags Windows registry modifications that enable developer feature settings under AppModelUnlock and Appx policy paths. Enabling these options can allow installation of untrusted packages or bypass intended trust and licensing checks. It relies on registry set telemetry by matching TargetObject paths and a DWORD value of 0x00000001.
references:
  - https://twitter.com/malmoeb/status/1560536653709598721
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_turn_on_dev_features.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-12
modified: 2023-08-17
tags:
  - attack.stealth
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \Microsoft\Windows\CurrentVersion\AppModelUnlock
      - \Policies\Microsoft\Windows\Appx\
    TargetObject|endswith:
      - \AllowAllTrustedApps
      - \AllowDevelopmentWithoutDevLicense
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1