Rule Info
Name
Potential Signing Bypass Via Windows Developer Features
Description
Detects when a user enable developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.
Reference
Internal Research
Modified
None
Date
2023-01-11 00:00:00
Author
Nasreddine Bencherchali (Nextron Systems)
Tags
attack.defense_evasion DEMO
Id
a383dec4-deec-4e6e-913b-ed9249670848
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR