Windows Registry change enabling developer features for sideloading and untrusted app installs
Alerts on registry writes that enable Windows developer feature policies allowing sideloading of untrusted apps.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-12
- Updated
- 2026-07-30
What it detects
This rule flags Windows registry modifications that enable developer feature settings under AppModelUnlock and Appx policy paths. Enabling these options can allow installation of untrusted packages or bypass intended trust and licensing checks. It relies on registry set telemetry by matching TargetObject paths and a DWORD value of 0x00000001.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-change-enabling-developer-features-for-sideloading-and-untruste-b110ebaf
title: Windows Registry change enabling developer features for sideloading and untrusted app installs
id: a568cb9d-83e1-4a0f-b012-60d8ef143a68
related:
- id: a383dec4-deec-4e6e-913b-ed9249670848
type: similar
- id: b110ebaf-697f-4da1-afd5-b536fa27a2c1
type: derived
status: test
description: This rule flags Windows registry modifications that enable developer feature settings under AppModelUnlock and Appx policy paths. Enabling these options can allow installation of untrusted packages or bypass intended trust and licensing checks. It relies on registry set telemetry by matching TargetObject paths and a DWORD value of 0x00000001.
references:
- https://twitter.com/malmoeb/status/1560536653709598721
- https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_turn_on_dev_features.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-12
modified: 2023-08-17
tags:
- attack.stealth
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- \Microsoft\Windows\CurrentVersion\AppModelUnlock
- \Policies\Microsoft\Windows\Appx\
TargetObject|endswith:
- \AllowAllTrustedApps
- \AllowDevelopmentWithoutDevLicense
Details: DWORD (0x00000001)
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1