huntrule

Windows Registry change enabling developer features for sideloading and untrusted app installs

Alerts on registry writes that enable Windows developer feature policies allowing sideloading of untrusted apps.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-01-12
Updated
2026-07-30
AnalysisDetection
title: Windows Registry change enabling developer features for sideloading and untrusted app installs
id: a568cb9d-83e1-4a0f-b012-60d8ef143a68
related:
  - id: a383dec4-deec-4e6e-913b-ed9249670848
    type: similar
  - id: b110ebaf-697f-4da1-afd5-b536fa27a2c1
    type: derived
status: test
description: This rule flags Windows registry modifications that enable developer feature settings under AppModelUnlock and Appx policy paths. Enabling these options can allow installation of untrusted packages or bypass intended trust and licensing checks. It relies on registry set telemetry by matching TargetObject paths and a DWORD value of 0x00000001.
references:
  - https://twitter.com/malmoeb/status/1560536653709598721
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_turn_on_dev_features.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-12
modified: 2023-08-17
tags:
  - attack.stealth
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \Microsoft\Windows\CurrentVersion\AppModelUnlock
      - \Policies\Microsoft\Windows\Appx\
    TargetObject|endswith:
      - \AllowAllTrustedApps
      - \AllowDevelopmentWithoutDevLicense
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1