Windows Developer Features Enabled for Sideloading
This rule detects attempts to enable Windows developer features such as 'Developer Mode' or 'Application Sideloading' via 'SystemSettingsAdminFlows.exe'. Enabling these features allows users to install untrusted packages, which can be leveraged by adversaries for defense evasion or persistence by bypassing standard application signing requirements.
Sigma
