UNCanny AppModelUnlock Developer Mode Registry Key Enabled for UNC AppX Coercion
Detects enumeration or modification of the AppModelUnlock registry key, specifically 'AllowDevelopmentWithoutDevLicense' or 'IsDeveloperModeEnabled', which are prerequisites for enabling Developer Mode. This activity is relevant to the UNCanny coercion primitive, which leverages loose-file UNC AppX package registration.
Microsoft Sentinel (KQL)
