Potential Signing Bypass Via Windows Developer Features - Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects when Windows developer features like "Developer Mode" or "Application Sideloading" are enabled by modifying specific registry keys. This allows users to install untrusted packages, potentially bypassing code signing requirements and enabling the execution of malicious applications.