Windows 10 Developer Mode enabled

BIOC Informational

Windows 10 Developer Mode enabled

Enabling developer mode allows for app sideloading and starts the Windows SSH services, which may be used to install Linux Bash on Windows.

Module:: Platform Analytics
Agent event type:: Registry
Category:: Evasion
Status:: Enabled

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Trusted Developer Utilities Proxy Execution (T1127)

Indicator:

Registry action type = create_registry_key , set_registry_value AND registry data = 1 AND registry key name = *SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense Host host os = windows

Preventable: yes